Conway-Phillips Holding LLC dba Phillips Tank & Structure Data Breach — Class Action Review

Conway-Phillips Holding LLC, operating under the well-known industry name Phillips Tank & Structure, functions as a specialized engineering, construction, and asset maintenance provider primarily serving heavy industry sectors such as petroleum, petrochemical, water, and power generation. Because the company designs, builds, and maintains critical storage tanks and industrial infrastructure, its operations require managing extensive administrative, engineering, and workforce data. This encompasses comprehensive internal human resources files, detailed payroll records for specialized trade labor and corporate personnel, subcontractor compliance documents, and proprietary vendor accounts. Consequently, the organization maintains a centralized repository of sensitive personally identifiable information belonging to current and former employees, contractors, and corporate partners.

In 2025, Conway-Phillips Holding LLC dba Phillips Tank & Structure reported a significant cybersecurity incident to the Indiana Attorney General. While industrial engineering firms are prime targets for cybercriminal enterprises due to their involvement in critical infrastructure supply chains, breaches of this nature typically involve sophisticated network intrusions, unauthorized access to internal databases, or compromised administrative credentials. Threat actors frequently exploit vulnerabilities in corporate IT networks to deploy ransomware or quietly exfiltrate vast stores of confidential documents. When a firm handling heavy industrial construction suffers such a compromise, the incident often points to potential vulnerabilities in digital perimeter defenses, inadequate employee credential safeguards, or third-party vendor access points.

The data compromised in the Phillips Tank & Structure security incident encompasses a dangerous array of sensitive personal details, including full legal names, Social Security numbers, dates of birth, home addresses, banking and direct deposit information, and tax withholding documentation. The exposure of this information creates severe, long-term risks for affected individuals. Social Security numbers and dates of birth form the foundational keys for identity theft, enabling malicious actors to open fraudulent credit accounts, secure unauthorized loans, or intercept government tax returns. Furthermore, compromised banking and direct deposit details expose victims to immediate financial account takeover, unauthorized wire transfers, and ongoing risks of financial fraud that require years of vigilance and credit monitoring to remediate.

As an employer and commercial entity operating within Indiana, Conway-Phillips Holding LLC dba Phillips Tank & Structure had a strict legal obligation under state data protection laws and common law principles of negligence to implement and maintain reasonable security measures to safeguard private personal information. These legal obligations mandate the use of robust encryption, advanced intrusion detection systems, rigorous access controls, and regular network vulnerability audits. The occurrence of a widespread data breach strongly indicates a failure in these foundational security duties. Under the law, companies that collect and store private data are responsible for maintaining a secure environment; failing to prevent unauthorized access can constitute a breach of statutory duties and corporate negligence.

Receiving a data breach notification letter from Conway-Phillips Holding LLC dba Phillips Tank & Structure is a formal admission that your private personal information was compromised due to inadequate security practices. Legally, this notification establishes the standing necessary to participate in a class action lawsuit aimed at holding the company accountable for failing to protect your data. Importantly, victims do not need to prove that financial fraud has already occurred to seek legal redress; the increased, imminent risk of identity theft and the time and expense required to protect oneself are recognized harms. Our firm evaluates these data breach claims on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only recover fees if we successfully secure a recovery on your behalf.