Smart ERP Solutions, Inc.; McLane Co., Inc.; United Airlines, Inc. data breach investigation

Investigation notes

The complex ecosystem of modern enterprise operations, workforce management, and supply chain logistics relies heavily on specialized technology vendors, enterprise resource planning (ERP) platforms, and corporate infrastructure providers. Organizations such as Smart ERP Solutions, Inc., McLane Co., Inc., and United Airlines, Inc. occupy pivotal roles across software integration, supply chain distribution, and aviation transport. In the course of managing large-scale operations, employee payroll, logistics coordination, and customer databases, these entities collectively aggregate and process massive volumes of deeply sensitive corporate, employee, and consumer data. Because these systems serve as centralized repositories for operational workflows and personnel administration, they inherently represent high-value targets for cybercriminals seeking to harvest valuable Personally Identifiable Information (PII) and corporate credentials.

In 2025, a significant security incident involving these corporate entities was formally reported to the Office of the Maryland Attorney General. While the precise technical mechanics of the intrusion continue to be scrutinized, incidents of this magnitude frequently stem from sophisticated cyberattacks, third-party vendor compromises, or unauthorized intrusions into enterprise database environments. When complex operational networks and administrative databases are compromised, malicious actors often exploit legacy software vulnerabilities, credential stuffing schemes, or third-party software supply chain weaknesses to bypass perimeter defenses and dwell undetected within internal networks for extended periods before exfiltrating sensitive data.

The exposure resulting from this data breach involves a dangerous amalgamation of sensitive personal information, which typically includes full names, Social Security numbers, dates of birth, financial account details, and employment or operational records. The compromise of such foundational data elements exposes victims to severe, long-term risks. Social Security numbers and dates of birth provide the building blocks for synthetic identity theft and fraudulent credit applications, while financial and direct deposit details open the door to unauthorized account takeovers and fraudulent wire transfers. Furthermore, compromised personnel files and corporate data can be leveraged by bad actors to conduct targeted phishing campaigns, business email compromise schemes, and unauthorized tax filings in the victims' names.

Under applicable state data protection laws, including the Maryland Personal Information Protection Act, as well as overarching federal standards regarding consumer protection and data security, entities that collect and maintain private personal information have an affirmative legal duty to implement and maintain reasonable security measures. This includes deploying robust encryption standards, conducting regular vulnerability assessments, monitoring network traffic for anomalous behavior, and rigorously vetting third-party vendors. The occurrence of a data breach of this scale strongly suggests a potential failure in these foundational security obligations, raising serious questions about whether adequate safeguards were in place to protect the confidential data entrusted to these organizations.

For individuals who have received an official data breach notification letter from Smart ERP Solutions, Inc., McLane Co., Inc., or United Airlines, Inc., the notice serves as formal legal confirmation that their private information was compromised due to corporate security shortcomings. Legally, the receipt of this letter establishes the foundational standing necessary to participate in a data breach class action lawsuit. Importantly, affected individuals are not required to demonstrate immediate financial loss or actualized identity theft to seek legal recourse; the increased risk of future harm and the forced expenditure of time and resources to monitor credit are actionable injuries. Our firm is currently investigating potential legal claims on a contingency fee basis, meaning affected class members pay absolutely no upfront costs or out-of-pocket legal fees, and we only recover compensation if a successful recovery is secured on your behalf.