USA DeBusk Data Breach: Is There a Lawsuit? (August 2026 Status)
The industrial-services company confirmed attackers took personal data in a 2025 incident — the notice letters list one of the broadest data sets we track, from Social Security numbers to bank cards, medical information and passwords. Firms are investigating. No settlement exists yet.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened at USA DeBusk
USA DeBusk — a Deer Park, Texas industrial cleaning and specialty-services company serving refineries and petrochemical plants across 55+ North American locations — experienced a cybersecurity incident on or around September 5, 2025. Following an investigation, the company determined on July 6, 2026 — ten months later — that an unauthorized party had obtained personal information from its systems. Per the sample notification letter, the affected data varied per person but potentially included names, contact details, dates of birth, Social Security numbers, driver's license and passport numbers, financial account information (bank accounts and payment cards), medical and health-related information, health insurance information, and usernames with passwords — one of the broadest exposure lists we track.
Case Details
As of August 17, 2026, no class action is confirmed filed. Attorneys working with ClassAction.org (sponsored by Bryson Harris Suciu & DeMay PLLC, announcement August 11, 2026) are investigating and collecting affected individuals — including anyone who received a USA DeBusk notification letter. This page tracks the docket from the first complaint on.
Current Status — Verified August 17, 2026
Who Is Affected?
The total count has not been disclosed. USA DeBusk employs hundreds across dozens of service centers, and industrial-services breaches typically hit current and former employees (payroll and benefits data explain the SSN + medical + insurance mix). The definitive signal is a notification letter from USA DeBusk — if you received one, your data was in the stolen set. Keep it.
What Could This Pay? (Honest Answer)
Case Timeline
- 1
On or around September 5, 2025: The incident
Attackers access USA DeBusk systems. The company's later notices date the incident here.
- 2
September 2025 – July 2026: Investigation
Forensic review runs for roughly ten months before the company confirms what was taken.
- 3
July 6, 2026: Data theft confirmed
USA DeBusk determines an unauthorized party obtained personal information — the broad list in the notification letters.
- 4
July–August 2026: Notification letters
Sample notices circulate; recipients learn their specific exposed fields.
- 5
August 11, 2026: Firms open investigations
Attorneys working with ClassAction.org begin collecting affected individuals for a potential class action.
- 6
Expected: first complaints
Breaches with this data breadth and a ten-month notice gap historically draw filings.
- 7
What's next
First complaint, then the standard breach-litigation path. We update this page at each milestone.
USA DeBusk Breach Scams
With passwords and contact data exposed, expect convincing fake outreach.
Fake 'DeBusk settlement claim' sites
No claims portal exists. Any payout form today is a scam. A real claims process would appear in court filings — and on this page.
Credential-stuffing and password-reset phishing
Stolen username/password pairs get tried everywhere. Change reused passwords now; treat 'verify your account' emails as hostile and log in directly instead.
Payroll/HR impersonation
Employees may get fake HR or benefits calls quoting real details. Verify through your known company contacts — never through numbers in unexpected messages.
USA DeBusk Data Breach FAQs
Is there a USA DeBusk settlement?
No. As of August 17, 2026 there is no settlement, no administrator, no fund — and no confirmed filed complaint. Firms are investigating and signing up notice recipients. We update this page when anything changes.
I got a notification letter. What does it mean?
Your data was in the stolen set — the letter lists which fields. Keep it; it's your proof of membership for any future settlement, and it's what investigating firms ask for first.
Why did it take ten months to tell me?
The incident dates to September 2025; the company confirmed the data theft on July 6, 2026. Long forensic timelines happen — but notice-delay is also a standard legal claim, because every month of silence is a month victims couldn't protect themselves.
What data was exposed?
Varied per person; the notice lists potentially: name, contact info, DOB, SSN, driver's license/passport numbers, bank account and payment-card information, medical and health-insurance information, and usernames with passwords. Your letter states your specific fields.
What should I do right now?
(1) Change every reused password — the credential exposure is the urgent part; (2) credit freezes at all three bureaus; (3) tell your bank; (4) watch insurance statements for care you never received; (5) document everything.
How much could a settlement pay?
Unknown — no case exists yet. The data breadth puts this in the serious tier; comparable settlements pay flat amounts plus documented-loss tiers. Anyone quoting a number today is guessing.
Do I need to sign up with a firm now?
No — a future class settlement would cover you automatically. Signing up helps firms build the case; it matters individually only if you suffer serious documented fraud from this breach.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.