EB Archbald & Associates Data Breach Investigation

The data breach lawyers at The Lyon Firm are investigating a recently reported data breach incident involving the personal information stored on the servers of EB Archbald & Associates, Inc., a specialized computer software provider for the oil and gas industry. Reports suggest as many as 17,000 individuals may have had their data compromised in the breach.

The Lyon Firm has filed numerous data breach lawsuits on behalf of clients in all fifty states. It is important to understand the security and privacy risks following a data theft event, and to work to mitigate those risks with certain measures such as the following:

• Remain vigilant by reviewing financial account statements and monitoring credit reports
• Place fraud alerts or security freezes with major credit bureaus
• Report any suspicious activity or suspected fraud to law enforcement and an experienced data breach attorney

What Happened at EB Archbald & Associates?

On March 23, 2025, EB Archbald allegedly experienced a ransomware attack, later claimed by a cybercriminal group. Qilin claimed responsibility for the data breach and noted that they had obtained 700 GB of company data. Such claims are not yet confirmed, though given the circumstances, that is a distinct possibility.

The attackers breached both the company’s servers and Microsoft cloud-based portal, encrypting all stored data and then demanded a ransom to be paid in exchange for a decryption key. The company allegedly refused to pay, Qilin threatened to release the stolen information online.

The compromised information may include personally identifiable information (PII) such as names, addresses, Social Security numbers, federal tax identification numbers, and sensitive financial data like bank account and routing numbers. On May 15, 2025, the company notified the California, Maine, and Texas Attorneys General. Impacted individuals will be formally notified in writing. In a sample data breach notification letter, EB states the following:

“On March 23, 2025, we discovered that our company had been the target of a so-called “ransomware” attack. The attackers hacked into our system and utilized software to encrypt all data on our servers and Microsoft cloud-based portal. In a subsequent communication the attackers demanded payment of a large sum of money in exchange for their release of a “decryption key”. We immediately contacted the local office of the Federal Bureau of Investigation and notified them of the attack. Per recommendations received from the FBI we refused to meet the attackers’ extortion demands. Five (5) days after their initial attack, and following our refusal to meet their monetary demand, we received a communication from the attackers claiming that they had downloaded information from our systems which they intended to release on the world wide web. Although the attackers have never provided any evidence to establish this claim, we cannot rule out the possibility that they accomplished an exfiltration of information and that they could follow through on their threat to release information.”