Royal Chemical Data Breach Exposes SSNs

Chemical Services Group Inc. dba Royal Chemical, a privately held holding company in the chemical manufacturing and industrial services sector, disclosed a data breach that exposed consumers' sensitive personal information.

The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on March 24, 2026. So far, four Massachusetts residents were reported as affected in the filing.

What happened in the Royal Chemical data breach

On May 14, 2025, a ransomware group known as Lynx posted a claim on the Tor network, a part of the internet that allows users to browse anonymously and is frequently used by cybercriminal groups to share stolen data.

In its posting, the Lynx group stated that Royal Chemical had fallen victim to its ransomware operation and claimed to have obtained the organization's data.

The personally identifiable information exposed in the breach included full names and Social Security numbers.

Royal Chemical's response to the breach

Royal Chemical notified affected individuals about the incident through a written notice.

Affected individuals are entitled to one free credit report every 12 months from each of the three major nationwide credit reporting companies. Consumers can request reports by calling 1-877-322-8228 or visiting AnnualCreditReport.com.

Steps to take if your information was exposed

• Place a fraud alert or credit freeze with Equifax (1-800-525-6285), Experian (1-888-397-3742) and TransUnion (1-800-680-7289) to help prevent new accounts from being opened using your Social Security number.
• Request your free credit reports at AnnualCreditReport.com and review them carefully for any accounts or inquiries you do not recognize.
• Monitor your bank and credit card statements regularly for any unauthorized charges or suspicious transactions.
• File a report with local law enforcement if you discover any signs of identity theft and keep a copy of the police report to provide to creditors if needed.
• Be cautious of phishing attempts that reference Chemical Services Group, Royal Chemical or this data breach by name, as scammers sometimes use real breach notifications to collect additional personal information.