Fluke Corporation Data Breach: What the 18,517 People Affected Should Know

Posted on : May 18, 2026Posted By : Matthew Russell
Posted In : Class Actions

The Fluke Corporation data breach exposed personal information for 18,517 people during a two-month intrusion that ran from August 10 through October 7, 2025. If you got a notice letter in the last few weeks, you’re one of them. The data taken includes the worst possible combination for identity theft — Social Security number, date of birth, and in some cases an indicator of self-identified disability status.

Here’s what actually happened, what your exposure looks like, and what to do in the next few weeks.

What happened

A criminal actor got into Fluke’s network through a vulnerability in a third-party business application Fluke uses. They were inside from August 10, 2025 through October 7, 2025 — about 58 days. Fluke didn’t catch it until later and didn’t notify the people affected until this spring.

Fluke is headquartered right here in Everett. The company makes industrial testing and measurement equipment and has been a fixture on the local employer list for decades. Most of the people getting notice letters are current or former employees, dependents on the company’s benefit plans, or applicants whose information was on file.

What was actually exposed

According to Fluke’s disclosure, the data accessed includes:

  • Social Security numbers
  • Dates of birth
  • For some people, an indicator that the person self-identified as having a disability (this typically comes from EEO-1 reporting or benefits enrollment forms)

That last category is unusual. Most breach notices stop at SSN and DOB. The disability indicator turns this into a more sensitive disclosure than the usual breach because it’s a health-adjacent data point tied to your name and SSN.

The notice you received probably offered credit monitoring through one of the standard vendors (Experian, Kroll, or similar) for 12 or 24 months. That’s standard practice. It’s also the bare minimum.

What credit monitoring actually does — and doesn’t do

Credit monitoring alerts you when a new account is opened in your name or your credit file changes. It’s reactive. It doesn’t prevent anyone from using your SSN. It just tells you after the fact, sometimes weeks after.

For a breach this severe — SSN, DOB, and a third sensitive data point all combined — credit monitoring alone isn’t enough. The people who buy stolen data on dark-web markets are patient. They’ll sit on a batch like this for a year or more before using it, specifically because most credit monitoring offers expire at 12 or 24 months. By the time the alerts stop, the data is still active.

What you should do, regardless of whether you decide to pursue a claim:

Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion. It’s free, takes about 15 minutes total online, and it actually blocks new accounts. Unlike monitoring, it’s preventive.

File an IRS Identity Protection PIN. Tax refund fraud is one of the fastest payoffs for someone holding stolen SSNs. The IRS has a free program (Form 15227 or online at IRS.gov) that requires a six-digit PIN to file your return.

Check your Social Security earnings record. Log into SSA.gov and pull your earnings statement. If someone is using your SSN for employment, it shows up here before it shows up anywhere else.

Keep the notice letter. Don’t throw it out. If something happens later, the date you received notice matters for both your damages and the legal deadline.

What kind of claim do people in this situation have

Washington has a couple of laws that apply to a breach like this.

The Washington Data Breach Notification Act (RCW 19.255) requires companies to notify Washington residents within 30 days of discovering a breach involving SSNs and other personal information. If Fluke missed that deadline — and the timeline suggests they may have, given the breach window ran through October 2025 — that’s a violation independent of whatever caused the breach in the first place.

The Washington Consumer Protection Act (RCW 19.86) allows lawsuits for unfair or deceptive business practices that cause injury. Storing sensitive personal data with inadequate security, then failing to disclose the breach promptly, can fit under that statute.

There’s also a negligence theory: Fluke had a duty to protect this data and arguably breached that duty by leaving a third-party application vulnerability open long enough for someone to spend two months inside the network.

What you’d be claiming damages for typically includes:

  • Time spent on credit freezes, IRS PINs, monitoring, and disputing fraudulent charges
  • Out-of-pocket costs (paid credit monitoring beyond what Fluke provided, identity theft restoration services, legal fees)
  • Documented identity theft losses if they occur
  • In some cases, emotional distress, especially given the disability-indicator disclosure
  • Loss of value of the data itself — courts in Washington have been more open to this theory in recent years than courts in some other states

Class actions are the typical vehicle for breaches this size. With 18,517 people affected, individual lawsuits don’t make economic sense for most claimants. A class action lets one or a small group of plaintiffs pursue the case on behalf of everyone.

Should you sign up with the first firm that contacts you

Probably not. The breach disclosure went out a few weeks ago and at least one out-of-state firm has already posted advertising specifically targeting Fluke victims. That’s normal — these cases move fast and firms compete for lead plaintiffs.

A few things worth knowing before you sign anything:

You don’t owe anyone a decision today. Data breach class actions take 18 to 36 months to resolve. There’s no rush in the first week.

Local matters in Washington. If a class action gets filed, it will likely be in federal court in the Western District of Washington (Seattle) given Fluke’s location. A firm with people in the state has logistical advantages.

The fee structure should be straightforward. Class action firms work on contingency — no fee unless there’s a recovery. Anyone asking for money up front isn’t running a real class action practice.

You’re a “class member,” not necessarily a “named plaintiff.” Most people in these cases don’t need to actively sign up at all. Once a case is certified, you get notice automatically as part of the affected class. Signing up with a firm now mostly matters if you want to be a lead plaintiff or want a specific firm representing your interests.

What we’re doing about it

Russell & Hill is based in Everett, the same town as Fluke. We’ve been watching the Fluke Corporation data breach since the disclosure came out and we’re evaluating the case for clients in Washington and Oregon. If you got a notice letter and want to talk through what your specific exposure looks like — what was in your particular notice, whether you’ve already seen suspicious activity, what your options are — call us at 425-212-9165. There’s no charge for the conversation and no obligation to do anything.

Whether you end up working with us, another firm, or no firm at all, freeze your credit this week. That’s the single most important thing you can do, and it doesn’t require a lawyer.

About the Author
Matthew-Russell
Matthew Russell
Matthew Russell is a founding partner at Russell & Hill, PLLC, and practices 100% personal injury law. He is admitted to the Washington bar (2001) and Oregon bar (2014). He earned his J.D. from Hamline University School of Law and his undergraduate degree from Clemson University. Matthew is a member of the Washington State Bar Association and Oregon State Bar Association. Connect with him on LinkedIn.

Frequently Asked Questions About Personal Injury Cases

Why Is My Lawyer Taking So Long to Settle My Case In Washington?
Who Pays Medical Bills After a Car Accident If You Weren’t at Fault?
What to Do After a Car Accident?
How much does it cost to hire an injury lawyer?
What should I do if the insurance company gives me a settlement?
Will my case go to trial?
Can You Sue Lyft for an Accident? Washington Legal Rights
How to File a Car Accident Report in Everett?
What should I do immediately after an injury?
How long do I have to file an injury claim?
How to Assess if Your Situation Qualifies for a Personal Injury Claim
What damages can I get in an injury case?
Lawyers

Settlements

$1.15M

Settlement


Auto Accident

$870K

Settlement


Auto Accident

$550K

Settlement


Auto Accident

$875K

Settlement


Wrongful Death

$300K

Settlement


Auto Accident

$210K

Settlement


Slip & Fall

$200K

Settlement


Auto Accident

$180K

Settlement


Slip & Fall

Get your FREE case evaluation today

If you would like more information or would like to talk to us about how we could help you.

We’re Ready to Help!

Have questions or need personalized legal assistance? Reach out to us at info@russellandhill.com, and we’ll discuss how we can support you every step of the way.

Spokane

1212 North Washington St, Suite 132 Spokane, WA 99201

(800) 529-0842 Get Directions

Everett

3811-A Broadway Everett, WA 98201

(800) 529-0842 Get Directions

Vancouver

502 NE 72nd St Suite 208 Vancouver, WA 98665

(800) 529-0842 Get Directions

Marysville

9317 State Ave, Suite A-4 Marysville, WA 98270

(800) 529-0842 Get Directions

Spokane Valley

9212 E Montgomery Ave Suite 401-5, Spokane Valley, WA 99206

(800) 529-0842 Get Directions