Morrow Equipment Company Data Breach — Class Action Review

Morrow Equipment Company operates as a specialized heavy equipment provider, specifically known across the construction and industrial sectors for supplying, renting, and servicing large tower cranes and related lifting machinery. Because of the heavy logistical, operational, and financial footprint required to manage multi-million-dollar heavy equipment fleets on major commercial and infrastructure projects, Morrow Equipment Company maintains an extensive workforce of specialized technicians, engineers, project managers, and administrative personnel. To support these operations, human resources, and payroll functions, the company routinely collects, processes, and stores vast quantities of sensitive personally identifiable information (PII) regarding its employees, contractors, and business partners.

In 2025, Morrow Equipment Company formally reported a significant data security incident to the Indiana Attorney General. While the full mechanics of the intrusion are still under active analysis, incidents affecting industrial equipment and machinery providers typically involve sophisticated cyberattacks, such as unauthorized network access, targeted malware deployment, or third-party vendor compromises that penetrate corporate databases. Given the distributed nature of heavy equipment operations—which often bridge central corporate offices with remote field sites and external vendor networks—malicious actors frequently exploit vulnerabilities in IT infrastructure to compromise internal systems where sensitive administrative and employee records are stored.

The data compromised in the Morrow Equipment Company breach exposes victims to severe, long-term risks of identity theft and financial fraud. Because industrial employers routinely maintain comprehensive human resources and payroll files, exposed records typically include full legal names, Social Security numbers, dates of birth, home addresses, and banking or direct deposit details. When Social Security numbers and financial account details fall into the hands of cybercriminals, victims face immediate threats of unauthorized bank withdrawals, fraudulent credit applications opened in their names, and compromised tax filings. The loss of this foundational personal data strips away an individual's financial privacy and forces them into a costly, time-consuming cycle of credit monitoring and fraud remediation.

As an employer and commercial entity operating within Indiana, Morrow Equipment Company had a clear, legally enforceable duty to implement and maintain reasonable cybersecurity safeguards to protect the sensitive PII entrusted to its care. Under state common law principles and applicable state consumer protection statutes, companies that collect employee data are required to maintain administrative, technical, and physical security controls commensurate with the sensitivity of the information. The occurrence of a widespread data breach strongly indicates a failure in these required security protocols, raising serious questions about whether Morrow Equipment Company utilized adequate encryption, multi-factor authentication, or timely vulnerability patching to defend its networks against foreseeable cyber threats.

For current and former employees, contractors, and affected individuals, receiving a data breach notification letter from Morrow Equipment Company is a formal admission that their private information has been compromised through corporate negligence. Legally, the receipt of this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Importantly, affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to seek legal redress. Our class action law firm is investigating potential claims against Morrow Equipment Company on a contingency fee basis, meaning there are never any out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf.