Takeda Pharmaceuticals USA Investigated Following Credential-Based Data Breach
Shamis & Gentile P.A., a class action law firm specializing in data breach cases, is examining a security incident involving Takeda Pharmaceuticals USA, Inc., the U.S. subsidiary of Japan-based Takeda Pharmaceutical Co. Ltd. The breach, discovered on February 23, 2026, stemmed from the compromise of an employee’s credentials by an unauthorized third party.
Takeda, a global biopharmaceutical company founded in 1781 and operating in 80 countries, maintains its U.S. headquarters in Lexington, Massachusetts. The company focuses on therapeutic areas including oncology, rare diseases, and vaccines.
After detecting the intrusion, Takeda contained the incident and notified law enforcement the same day. A subsequent investigation concluded on April 24, 2026, that the unauthorized party may have accessed files containing personally identifiable information (PII). By May 5, 2026, the company confirmed that sensitive data including names, Social Security numbers, driver’s licenses, financial account details, medical records, and dates of birth had been exposed for some individuals.
Takeda reported the breach to the Massachusetts Attorney General’s office on June 2, 2026, and to the New Hampshire Attorney General’s office on May 29, 2026. Legal representatives are now assessing potential compensation claims for affected individuals.
Source: https://www.claimdepot.com/investigations/takeda-pharmaceuticals-data-breach-2026
TAKEDA PHARMACEUTICALS AMERICA, INC. cybersecurity rating report: https://www.rankiteo.com/company/takeda-pharmaceuticals-america-inc.
"id": "TAK1780684206",
"linkid": "takeda-pharmaceuticals-america-inc.",
"type": "Breach",
"date": "2/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Biopharmaceutical',
'location': 'Lexington, Massachusetts, USA',
'name': 'Takeda Pharmaceuticals USA, Inc.',
'size': 'Large (Global presence in 80 countries)',
'type': 'Corporation'}],
'attack_vector': 'Compromised Credentials',
'data_breach': {'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Social Security numbers',
'Driver’s licenses',
'Financial account details',
'Medical records',
'Dates of birth']},
'date_detected': '2026-02-23',
'date_publicly_disclosed': '2026-06-02',
'date_resolved': '2026-04-24',
'description': 'Shamis & Gentile P.A. is investigating a security incident '
'involving Takeda Pharmaceuticals USA, Inc., where an '
'unauthorized third party compromised an employee’s '
'credentials, leading to potential access of personally '
'identifiable information (PII).',
'impact': {'data_compromised': 'Personally Identifiable Information (PII)',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential compensation claims',
'payment_information_risk': 'High'},
'initial_access_broker': {'entry_point': 'Compromised employee credentials'},
'investigation_status': 'Concluded',
'post_incident_analysis': {'root_causes': 'Compromised credentials'},
'references': [{'source': 'Shamis & Gentile P.A.'}],
'regulatory_compliance': {'legal_actions': 'Potential class action '
'investigation',
'regulatory_notifications': ['Massachusetts '
'Attorney General’s '
'office',
'New Hampshire '
'Attorney General’s '
'office']},
'response': {'communication_strategy': 'Notifications to Attorney General '
'offices',
'containment_measures': 'Incident contained on detection',
'incident_response_plan_activated': True,
'law_enforcement_notified': True},
'threat_actor': 'Unauthorized Third Party',
'title': 'Takeda Pharmaceuticals USA Credential-Based Data Breach',
'type': 'Data Breach'}