Fresenius Kabi data breach: employee records on the network of its Ivenix subsidiary

Date	Event
January 6 to 9, 2026	Unauthorized access to the Ivenix network with valid credentials
January 8, 2026	Fresenius learns of a third party claiming to have accessed company data
After January 8, 2026	Preliminary notice and interim credit monitoring offered to current employees
April 29, 2026	Review finds the letter recipient's information among the affected data
June 17, 2026	Letters; reports to Massachusetts (285) and New Hampshire (131)

What happened at Fresenius Kabi?

The company found out from the attacker. Its letter says that on January 8, 2026, Fresenius became aware of a third party claiming to have accessed certain company data without authorization, and that it then brought in external forensic experts. The investigation placed the access between January 6 and 9, on a network associated with Ivenix. The notice to New Hampshire says the actor used valid credentials but does not say how they were obtained.

Counsel's notice to New Hampshire describes the response in more detail than most notices do. The steps included network-level containment that isolated affected systems, restricted external connectivity, restored key system backups and ran threat hunting across the environment. Fresenius's security tools automatically contained at least one compromised device. Later fixes include upgraded firewalls, wider deployment of endpoint detection and response (EDR), and more logging.

Was data stolen from Fresenius Kabi?

Fresenius says it cannot show that it was. Its investigation had not found definitive evidence that the third party successfully exfiltrated any data. The letter to individuals puts it the same way: its findings do not indicate that the third party downloaded any information. The third party's own claim to have accessed company data is what started the investigation.

What information was exposed?

The letter lists name, contact details, date of birth, government identification such as Social Security number, driver's license number or passport information, financial account information, and certain medical information. The notice to New Hampshire says the data included employees' information. Massachusetts marks all five categories.

Record	People	Data it marks
Massachusetts OCABR, report 2026-991	285	SSNs, medical records, financial accounts, driver's licenses, card numbers
New Hampshire DOJ notice, June 17, 2026	about 131	SSN, driver's license or financial account number

What is Fresenius Kabi offering?

Twenty-four months of Experian credit monitoring at no cost. Current employees were offered interim monitoring earlier, with the preliminary notice. Former employees whose records were on the Ivenix network may be hearing about it for the first time from the June letter. For how these offers compare, see the credit monitoring guide. For other incidents where the attacker's claim came first, see the double extortion guide.

What the documents leave open

• How the valid credentials were obtained, and who made the January 8 claim.
• The total number of people notified across all states.
• Whether any data was published.