Builders FirstSource Flex Plan and Builders FirstSource Inc.: Builders FirstSource Data Breach Exposes Health Information for Individuals

Builders FirstSource Flex Plan Reports Data Breach Affecting 1,514 Individuals

Builders FirstSource Flex Plan, a U.S.-based entity linked to building materials supplier Builders FirstSource Inc., disclosed a data breach impacting 1,514 individuals. The incident was formally reported to the U.S. Department of Health and Human Services (HHS) on February 18, 2026, as it involved protected health information (PHI).

Prior to the official disclosure, the threat actor Leaknet claimed responsibility for the breach on December 30, 2025, posting on the dark web and threatening to release the stolen data within 24 hours. Public filings do not specify when the unauthorized access began, how long it persisted, or when the company first detected the breach.

While the breach involved PHI, the exact types of exposed data such as medical records, personal identifiers, or financial details have not been publicly detailed. Builders FirstSource Flex Plan has begun notifying affected individuals via mail, outlining the compromised information, the company’s response, and available protective measures. Those who suspect they were impacted but have not received a notification are advised to contact the company directly.

Source: https://www.claimdepot.com/data-breach/builders-firstsource-2026

Builders FirstSource cybersecurity rating report: https://www.rankiteo.com/company/builders-firstsource

"id": "BUI1774909946",
"linkid": "builders-firstsource",
"type": "Breach",
"date": "12/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '1514',
                        'industry': 'Building Materials, Healthcare Benefits',
                        'location': 'U.S.',
                        'name': 'Builders FirstSource Flex Plan',
                        'type': 'Subsidiary'}],
 'customer_advisories': 'Affected individuals notified via mail; others '
                        'advised to contact the company if impacted.',
 'data_breach': {'data_exfiltration': 'Threatened by Leaknet',
                 'number_of_records_exposed': '1514',
                 'personally_identifiable_information': 'Likely',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Protected Health Information '
                                             '(PHI)'},
 'date_publicly_disclosed': '2026-02-18',
 'description': 'Builders FirstSource Flex Plan, a U.S.-based entity linked to '
                'building materials supplier Builders FirstSource Inc., '
                'disclosed a data breach impacting 1,514 individuals. The '
                'incident involved protected health information (PHI) and was '
                'reported to the U.S. Department of Health and Human Services '
                '(HHS). The threat actor Leaknet claimed responsibility for '
                'the breach and threatened to release the stolen data on the '
                'dark web.',
 'impact': {'data_compromised': 'Protected Health Information (PHI)',
            'identity_theft_risk': 'High'},
 'ransomware': {'data_exfiltration': 'Threatened'},
 'references': [{'source': 'U.S. Department of Health and Human Services '
                           '(HHS)'}],
 'regulatory_compliance': {'regulations_violated': ['HIPAA'],
                           'regulatory_notifications': 'Reported to U.S. '
                                                       'Department of Health '
                                                       'and Human Services '
                                                       '(HHS)'},
 'response': {'communication_strategy': 'Mail notifications to affected '
                                        'individuals'},
 'threat_actor': 'Leaknet',
 'title': 'Builders FirstSource Flex Plan Data Breach',
 'type': 'Data Breach'}