A former Swagelok employee has taken the Solon-based manufacturer to court, accusing the company of failing to protect his personal information after hackers broke into its computer network this summer. The suit, filed in Cuyahoga County, seeks to turn one man's complaint into a class action. It lands at a moment when ransomware crews are racking up record numbers of victims, with industrial companies squarely in the crosshairs.
James Gilbert, a Cleveland man and former Swagelok employee, filed the civil suit in Cuyahoga County Court of Common Pleas, according to Cleveland.com. He accuses the company of failing to implement the security measures needed to reduce the likelihood of a breach. His attorney is Terence Coates.
Swagelok, which makes fluid system components including hoses, valves and pressure regulators, discovered the intrusion on Aug. 30, the lawsuit says. Hackers with a ransomware group called iah6477 allegedly breached the company's IT network and stole 881 gigabytes of data. A reporter contacted Swagelok seeking comment on the suit.
What the Lawsuit Says Was Stolen
The complaint alleges that unencrypted, unredacted private information was compromised because of the company's “negligent and/or careless acts and omissions.” It specifies that names and Social Security numbers were taken and says other information was compromised as well.
The suit also seeks to qualify as a class action, which would extend it to others affected by the breach. Whether a court has granted that status is not established, and the case is still at its opening stage.
The company is no small player in the region. With more than 4,300 employees in Northeast Ohio, Swagelok ranked as the 23rd-largest employer in the area on a 2025 list from Crain's Cleveland Business, per the same Cleveland.com report.
Who Is iah6477?
The group blamed for the breach is relatively new. SOCRadar describes iah6477 as a financially motivated extortion and ransomware group that surfaced in August 2026 and primarily targets enterprises in the United States. The firm says the group uses double-extortion tactics, threatening to leak sensitive data online while demanding ransom payments.
SOCRadar's profile says the group gains initial access through infostealer malware and compromised corporate credentials, and that it exfiltrates large volumes of sensitive data before making demands. In a blog post, the firm said hackers obtained records time-stamped from December 2024 to August 2026, a span it said suggests a prolonged period of potential vulnerability.
The size of the alleged haul stands out. An Australian cybersecurity firm, Triskele Labs, puts the average hacking haul in its region at about 446 gigabytes, roughly half of what iah6477 is accused of stealing from Swagelok, Cleveland.com reports.
A Record Month for Ransomware
The breach unfolded during a brutal stretch for corporate defenders. NCC Group reported that 1,073 companies fell victim to ransomware attacks globally in August, a record high for the year and 12% more than in July, according to Infosecurity Magazine.
North America was the most common target region, accounting for 44% of incidents. The industrial sector was the most frequently hit industry, making up almost a third, or 31%, of reported incidents. The report also notes that some cybercriminal groups have moved away from encryption in favor of going straight for outright data theft and extortion.
