Form Energy, Inc., a U.S.-based renewables and energy storage company, suffered a ransomware attack discovered on September 16, 2025, exposing personally identifiable information (PII) of current and former employees (as of September 2023). The breach compromised highly sensitive data, including names, addresses, dates of birth, Social Security numbers, bank account numbers, driver’s licenses, permanent resident cards, alien registration cards, and passports. The incident affected at least 622 individuals in Massachusetts, with the company issuing official notices on October 22, 2025, and reporting the breach to the Massachusetts Attorney General on October 28, 2025. The exposed data poses severe risks of identity theft, financial fraud, and long-term reputational harm to victims. Form Energy offered 24 months of free credit monitoring via Experian IdentityWorks as a remedial measure, but the breach’s scale and sensitivity of leaked information warrant significant concern over potential misuse.
Source: https://www.claimdepot.com/investigations/form-energy-data-breach-2025
TPRM report: https://www.rankiteo.com/company/form-energy
"id": "for3902439102925",
"linkid": "form-energy",
"type": "Ransomware",
"date": "9/2023",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'No (employees only)',
'industry': 'Renewables & Environment (Energy Storage)',
'location': 'United States (West Virginia, '
'Massachusetts, California)',
'name': 'Form Energy, Inc.',
'type': 'Private Company'}],
'customer_advisories': 'N/A (employees affected, not customers)',
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': 'At least 622 (in Massachusetts '
'alone; total unknown)',
'personally_identifiable_information': ['Full Name',
'Address',
'Date of Birth',
'Social Security '
'Number (SSN)',
'Bank Account Number',
'Driver’s License',
'Permanent Resident '
'Card',
'Alien Registration '
'Card',
'Passport'],
'sensitivity_of_data': 'High (includes SSNs, bank account '
'numbers, government-issued IDs)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Financial Data']},
'date_detected': '2025-09-16',
'date_publicly_disclosed': '2025-10-22',
'description': 'Form Energy, Inc., a U.S.-based renewables and environment '
'company specializing in long-duration energy storage systems, '
'experienced a ransomware attack discovered on September 16, '
'2025. The breach exposed personally identifiable information '
'(PII) of current and former employees (as of September 2023), '
'including names, addresses, dates of birth, Social Security '
'numbers, bank account numbers, driver’s licenses, and '
'passport details. The company reported the breach to the '
'Massachusetts Attorney General on October 28, 2025, affecting '
'at least 622 individuals in Massachusetts. Affected parties '
'were offered 24 months of free Experian IdentityWorks credit '
'monitoring and identity theft protection services.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'exposure of sensitive employee PII',
'data_compromised': True,
'identity_theft_risk': 'High (PII including SSNs, bank account '
'numbers, and passport details exposed)',
'legal_liabilities': 'Potential lawsuits and compensation claims '
'from affected individuals',
'payment_information_risk': 'High (bank account numbers '
'compromised)'},
'investigation_status': 'Ongoing (legal investigation by Shamis & Gentile '
'P.A.)',
'ransomware': {'data_exfiltration': True},
'recommendations': ['Enroll in free credit monitoring (Experian '
'IdentityWorks) by 2026-01-31',
'Monitor financial statements for suspicious activity',
'Place a fraud alert on credit reports',
'Request free annual credit reports from major bureaus',
'Consider legal action for compensation'],
'references': [{'source': 'Shamis & Gentile P.A. Investigation Notice'},
{'date_accessed': '2025-10-28',
'source': 'Massachusetts Attorney General Data Breach '
'Notification'}],
'regulatory_compliance': {'legal_actions': 'Potential class-action lawsuits '
'(investigation ongoing by Shamis '
'& Gentile P.A.)',
'regulatory_notifications': 'Massachusetts Attorney '
'General (reported on '
'2025-10-28)'},
'response': {'communication_strategy': 'Mailed official notices to impacted '
'individuals (starting 2025-10-22); '
'reported to Massachusetts Attorney '
'General (2025-10-28)',
'incident_response_plan_activated': True,
'recovery_measures': 'Offered 24 months of free Experian '
'IdentityWorks credit monitoring and '
'identity theft protection services to '
'affected individuals (deadline: '
'2026-01-31)'},
'stakeholder_advisories': 'Official notices mailed to affected individuals '
'(2025-10-22)',
'title': 'Form Energy, Inc. Data Breach and Ransomware Attack (2025)',
'type': ['Data Breach', 'Ransomware Attack']}