Former employee sues Northeast Ohio manufacturing giant over data breach

CLEVELAND, Ohio -- A Cleveland man is suing one of Northeast Ohio’s biggest companies, saying a data breach landed his Social Security number on the dark web.

On Tuesday, former Swagelok employee James Gilbert filed the civil suit against his former employer in Cuyahoga County Court of Common Pleas, accusing the Solon manufacturing company of failing to protect his personal information.

On Aug. 30, the company discovered hackers with a ransomware group called iah6477 breached the company’s IT network and stole 881 gigabytes of data.

That’s not an insignificant amount. A report this month from Australian cybersecurity firm Triskele Labs said the average hacking haul in its region of the world is 446 gigabytes – half of what iah6477 is accused of stealing.

According to internet security firm SOCRadar , the hacking group emerged in August of this year and targets American businesses by extracting troves of data and demanding ransom payments.

Gilbert, represented by attorney Terence Coates, said Swagelok failed to implement necessary security measures to lessen the likelihood of a breach.

“This unencrypted, unredacted private information was compromised due to Defendant’s negligent and/or careless acts and omissions and its utter failure to protect individuals’ sensitive data,” the lawsuit said.

The lawsuit specifies that names and social security numbers were stolen, but says that other information was compromised as well. Now that the information is online, it’s all but certain to stay there, the lawsuit said.

Swagelok, which makes fluid system components like hoses, valves and pressure regulators, boasts a significant presence in Northeast Ohio’s economy. With more than 4,300 employees in Northeast Ohio , Swagelok is the 23rd largest employer in the region, according to a 2025 list compiled by Crain’s Cleveland Business.

A reporter reached out to Swagelok seeking .

Though Gilbert does not identify other people who were affected by the breach, the lawsuit seeks to qualify as a class-action suit, which indicates the plaintiff believes others were affected.

According SOCRadar, which was cited in the complaint, hackers obtained records time-stamped from December 2024 to August 2026.

“The extensive timeframe of compromised credentials suggests a prolonged period of potential vulnerability for the company,” SOCRadar said in a blog post.