Ransomware: termite claims Indiana Mills and Manufacturing (US) — Manufacturing

A new ransomware incident has been publicly reported involving the Termite group, which claims to have breached Indiana Mills and Manufacturing, a U.S.-based manufacturing company. The event was published on the ransomware tracking platform ransomware.live on May 30, 2026, under the BREACH framework. This is not a regulatory change but a confirmed data security incident that may trigger notification obligations under EU GDPR, particularly if any personal data of EU residents is involved.

The primary affected organization is Indiana Mills and Manufacturing, operating in the manufacturing sector. However, any EU-based company that shares supply chain data, processes personal data from this U.S. manufacturer, or has similar exposure to ransomware groups like Termite should consider themselves indirectly affected. Manufacturing firms with cross-border data flows or third-party vendor relationships are especially vulnerable.

Compliance teams should immediately verify whether any EU personal data was compromised in this breach, assess contractual obligations with the affected U.S. entity, and prepare a data breach notification to relevant EU supervisory authorities if required. Additionally, teams should review their own ransomware response plans, ensure offline backups are current, and reinforce employee training on phishing and credential theft, as these are common entry points for such groups.