Fluke Corporation Data Breach: What the 18,517 People Affected Should Know

Google Review
Publicado el: mayo 18, 2026Publicado por: Matthew Russell
Publicado en: Class Actions

The Fluke Corporation data breach exposed personal information for 18,517 people during a two-month intrusion that ran from August 10 through October 7, 2025. If you got a notice letter in the last few weeks, you’re one of them. The data taken includes the worst possible combination for identity theft — Social Security number, date of birth, and in some cases an indicator of self-identified disability status.

Here’s what actually happened, what your exposure looks like, and what to do in the next few weeks.

What happened

A criminal actor got into Fluke’s network through a vulnerability in a third-party business application Fluke uses. They were inside from August 10, 2025 through October 7, 2025 — about 58 days. Fluke didn’t catch it until later and didn’t notify the people affected until this spring.

Fluke is headquartered right here in Everett. The company makes industrial testing and measurement equipment and has been a fixture on the local employer list for decades. Most of the people getting notice letters are current or former employees, dependents on the company’s benefit plans, or applicants whose information was on file.

What was actually exposed

According to Fluke’s disclosure, the data accessed includes:

  • Social Security numbers
  • Dates of birth
  • For some people, an indicator that the person self-identified as having a disability (this typically comes from EEO-1 reporting or benefits enrollment forms)

That last category is unusual. Most breach notices stop at SSN and DOB. The disability indicator turns this into a more sensitive disclosure than the usual breach because it’s a health-adjacent data point tied to your name and SSN.

The notice you received probably offered credit monitoring through one of the standard vendors (Experian, Kroll, or similar) for 12 or 24 months. That’s standard practice. It’s also the bare minimum.

What credit monitoring actually does — and doesn’t do

Credit monitoring alerts you when a new account is opened in your name or your credit file changes. It’s reactive. It doesn’t prevent anyone from using your SSN. It just tells you after the fact, sometimes weeks after.

For a breach this severe — SSN, DOB, and a third sensitive data point all combined — credit monitoring alone isn’t enough. The people who buy stolen data on dark-web markets are patient. They’ll sit on a batch like this for a year or more before using it, specifically because most credit monitoring offers expire at 12 or 24 months. By the time the alerts stop, the data is still active.

What you should do, regardless of whether you decide to pursue a claim:

Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion. It’s free, takes about 15 minutes total online, and it actually blocks new accounts. Unlike monitoring, it’s preventive.

File an IRS Identity Protection PIN. Tax refund fraud is one of the fastest payoffs for someone holding stolen SSNs. The IRS has a free program (Form 15227 or online at IRS.gov) that requires a six-digit PIN to file your return.

Check your Social Security earnings record. Log into SSA.gov and pull your earnings statement. If someone is using your SSN for employment, it shows up here before it shows up anywhere else.

Keep the notice letter. Don’t throw it out. If something happens later, the date you received notice matters for both your damages and the legal deadline.

What kind of claim do people in this situation have

Washington has a couple of laws that apply to a breach like this.

El Washington Data Breach Notification Act (RCW 19.255) requires companies to notify Washington residents within 30 days of discovering a breach involving SSNs and other personal information. If Fluke missed that deadline — and the timeline suggests they may have, given the breach window ran through October 2025 — that’s a violation independent of whatever caused the breach in the first place.

El Washington Consumer Protection Act (RCW 19.86) allows lawsuits for unfair or deceptive business practices that cause injury. Storing sensitive personal data with inadequate security, then failing to disclose the breach promptly, can fit under that statute.

There’s also a negligence theory: Fluke had a duty to protect this data and arguably breached that duty by leaving a third-party application vulnerability open long enough for someone to spend two months inside the network.

What you’d be claiming damages for typically includes:

  • Time spent on credit freezes, IRS PINs, monitoring, and disputing fraudulent charges
  • Out-of-pocket costs (paid credit monitoring beyond what Fluke provided, identity theft restoration services, legal fees)
  • Documented identity theft losses if they occur
  • In some cases, emotional distress, especially given the disability-indicator disclosure
  • Loss of value of the data itself — courts in Washington have been more open to this theory in recent years than courts in some other states

Class actions are the typical vehicle for breaches this size. With 18,517 people affected, individual lawsuits don’t make economic sense for most claimants. A class action lets one or a small group of plaintiffs pursue the case on behalf of everyone.

Should you sign up with the first firm that contacts you

Probably not. The breach disclosure went out a few weeks ago and at least one out-of-state firm has already posted advertising specifically targeting Fluke victims. That’s normal — these cases move fast and firms compete for lead plaintiffs.

A few things worth knowing before you sign anything:

You don’t owe anyone a decision today. Data breach class actions take 18 to 36 months to resolve. There’s no rush in the first week.

Local matters in Washington. If a class action gets filed, it will likely be in federal court in the Western District of Washington (Seattle) given Fluke’s location. A firm with people in the state has logistical advantages.

The fee structure should be straightforward. Class action firms work on contingency — no fee unless there’s a recovery. Anyone asking for money up front isn’t running a real class action practice.

You’re a “class member,” not necessarily a “named plaintiff.” Most people in these cases don’t need to actively sign up at all. Once a case is certified, you get notice automatically as part of the affected class. Signing up with a firm now mostly matters if you want to be a lead plaintiff or want a specific firm representing your interests.

What we’re doing about it

Russell & Hill is based in Everett, the same town as Fluke. We’ve been watching the Fluke Corporation data breach since the disclosure came out and we’re evaluating the case for clients in Washington and Oregon. If you got a notice letter and want to talk through what your specific exposure looks like — what was in your particular notice, whether you’ve already seen suspicious activity, what your options are — call us at 425-212-9165. There’s no charge for the conversation and no obligation to do anything.

Whether you end up working with us, another firm, or no firm at all, freeze your credit this week. That’s the single most important thing you can do, and it doesn’t require a lawyer.

Acerca del autor
Matthew-Russell
Matthew Russell
Matthew Russell es socio fundador de Russell & Hill, PLLC, y ejerce la abogacía de lesiones personales 100%. Está admitido en el Colegio de Abogados de Washington (2001) y en el de Oregón (2014). Obtuvo su doctorado en Derecho en la Facultad de Derecho de la Universidad de Hamline y su licenciatura en la Universidad de Clemson. Matthew es miembro del Colegio de Abogados del Estado de Washington y del Colegio de Abogados del Estado de Oregón. Contáctenos en LinkedIn.
Categorías

Preguntas frecuentes sobre casos de lesiones personales

¿Por qué mi abogado tarda tanto en resolver mi caso en Washington?
¿Quién paga las facturas médicas después de un accidente automovilístico si usted no tuvo la culpa?
¿Qué hacer después de un accidente automovilístico?
¿Cuánto cuesta contratar a un abogado de lesiones?
¿Qué debo hacer si la compañía de seguros me ofrece un acuerdo?
¿Mi caso irá a juicio?
¿Se puede demandar a Lyft por un accidente? Derechos legales en Washington
¿Cómo presentar un informe de accidente automovilístico en Everett?
¿Qué debo hacer inmediatamente después de una lesión?
¿Cuánto tiempo tengo para presentar una reclamación por lesiones?
Cómo evaluar si su situación califica para una reclamación por lesiones personales
¿Qué daños puedo obtener en un caso de lesiones?
Lawyers

Asentamientos

$1.15M

Asentamiento

Accidente automovilístico

$870K

Asentamiento

Accidente automovilístico

$550K

Asentamiento

Accidente automovilístico

$875K

Asentamiento

Muerte por negligencia

$300K

Asentamiento

Accidente automovilístico

$210K

Asentamiento

Resbalón y caída

$200K

Asentamiento

Accidente automovilístico

$180K

Asentamiento

Resbalón y caída

Obtenga su evaluación de caso GRATUITA hoy

Si desea más información o quiere hablar con nosotros sobre cómo podemos ayudarle.

¡Estamos listos para ayudar!

¿Tiene preguntas o necesita asistencia legal personalizada? Contáctenos en info@russellandhill.comy discutiremos cómo podemos apoyarlo en cada paso del camino.

Google Review

Spokane

1212 North Washington St, Suite 132, Spokane, WA 99201

(800) 529-0842 Obtener direcciones

Everett

3811-A Broadway Everett, WA 98201

(800) 529-0842 Obtener direcciones

Vancouver

502 NE 72nd St Suite 208 Vancouver, WA 98665

(800) 529-0842 Obtener direcciones

Marysville

9317 State Ave, Suite A-4, Marysville, WA 98270

(800) 529-0842 Obtener direcciones

Valle de Spokane

9212 E Montgomery Ave, Suite 401-5, Spokane Valley, WA 99206

(800) 529-0842 Obtener direcciones