Boart Longyear Group, Ltd. data breach investigation

Investigation notes

Boart Longyear Group, Ltd. operates as a leading global provider of drilling services, tool manufacturing, and performance tooling to the mining and natural resource industries. Because of its expansive operations spanning multiple continents, the organization relies on robust human resources, supply chain, and administrative infrastructure. Consequently, Boart Longyear maintains extensive records containing sensitive personally identifiable information (PII) for thousands of current and former employees, contractors, and business partners. This repository typically includes high-value personal data collected during the onboarding, payroll processing, benefits administration, and ongoing employment lifecycle.

In 2025, Boart Longyear formally reported a security incident to the Maryland Attorney General, signaling that unauthorized actors had compromised its digital environment. In the context of heavy industrial, manufacturing, and natural resource sector organizations, incidents of this nature frequently involve sophisticated cyberattacks, such as ransomware deployments or targeted network intrusions. These events often exploit vulnerabilities in corporate legacy systems, third-party vendor connections, or remote access points, allowing malicious actors to dwell undetected within corporate networks and exfiltrate large volumes of confidential files.

The data compromised in incidents affecting organizations like Boart Longyear typically encompasses a broad spectrum of sensitive information, including full names, Social Security numbers, dates of birth, banking and direct deposit details, home addresses, and compensation figures. The exposure of this information creates immediate and severe risks for affected individuals. Social Security numbers and dates of birth are the foundational building blocks for identity theft, enabling threat actors to open fraudulent credit accounts, secure unauthorized loans, or drain financial accounts. Furthermore, compromised payroll and banking details expose victims to direct financial fraud, tax refund theft, and unauthorized fund transfers, creating long-term financial distress.

Under applicable state data protection statutes, such as the Maryland Personal Information Protection Act (MPIPA), as well as common law negligence principles, companies like Boart Longyear have an affirmative legal obligation to implement and maintain reasonable and appropriate security measures to safeguard private personal data. When a breach occurs, it often demonstrates a failure in these critical duties—such as failing to maintain adequate network segmentation, patch known software vulnerabilities, deploy multi-factor authentication, or properly vet third-party vendors. These shortcomings form the foundation of potential legal liability, suggesting that the breach could have been prevented with standard, industry-accepted cybersecurity practices.

For individuals who receive an official data breach notification letter from Boart Longyear, the letter serves as formal acknowledgment that their private information was compromised due to inadequate security controls. Legally, receipt of this notification establishes standing to participate in class action litigation aimed at holding the company accountable for its security failures. Under the law, victims of data breaches are not required to prove they have already suffered actual financial loss to seek legal relief; the increased risk of future identity theft and the loss of privacy are sufficient grounds. Our firm is currently investigating potential class action claims on behalf of affected individuals on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless a recovery is successfully obtained.