Builders FirstSource Flex Plan Data Breach 2026 (Leaknet Ransomware via Alpine Lumber): 1,514 Employee Health Plan Members Exposed. What To Do

What happened

Builders FirstSource, Inc. (NYSE: BLDR) is a major US building products company. The “Builders FirstSource Flex Plan” listed on the HHS OCR portal is the company’s cafeteria / Section 125 employee health plan vehicle — a HIPAA-covered entity. The breach itself did not originate at Builders FirstSource corporate; it originated at its recently acquired Colorado subsidiary Alpine Lumber Company (~21 Colorado locations).

On December 14, 2025, an unauthorized actor began accessing and exfiltrating files from an Alpine Lumber file server. On December 22, 2025, ransomware encryption was discovered on network devices and investigation began. On December 30, 2025, the Leaknet extortion group posted BLDR/Alpine on its Tor leak site with a 24-hour publication threat.

On February 18, 2026, Builders FirstSource Flex Plan and Alpine Lumber issued dual filings:

• Builders FirstSource Flex Plan filed with HHS OCR for 1,514 health-plan-enrolled employees
• Alpine Lumber filed with the Vermont AG covering a broader, undetermined victim count with broader PII categories
• Individual notification letters mailed
• Alpine Lumber posted a website notice

The 1,514 figure represents the HIPAA-covered slice — the subset of Alpine Lumber employees whose health plan enrollment data was in the stolen file shares. The total affected population (Alpine Lumber PII) is larger but undisclosed.

Leaknet is an extortion group tracked by WatchGuard and Red Piranha. Cyble research suggests Leaknet operations leverage leaked ransomware builders — typical of the post-LockBit-leak landscape.

What was stolen

Per Vermont AG filing and Strauss Borrelli investigation:

• Full name, home address
• Social Security number
• Date of birth
• Health insurance plan enrollment information
• Health insurance policy number
• Medical information
• Driver’s license number
• Passport number
• Government ID number
• Financial account details
• Payment card information

The combination of SSN + financial accounts + payment cards + passport is a high-tier identity-theft and travel-fraud exposure profile.

What is being offered

Complimentary credit monitoring + identity protection arranged for eligible individuals (vendor and duration not disclosed in available sources). Law enforcement notified; third-party forensic firm engaged.

Read your specific notification letter for the credit monitoring vendor name, duration, enrollment instructions, and call center number.

What to do

1. Read your specific notification letter to confirm what data elements were involved and the exact remediation offered.
2. If you are an Alpine Lumber employee or recent former employee, contact your HR team for guidance — multiple data categories may be in scope beyond the HIPAA-covered subset.
3. Place free credit freezes at Equifax, Experian, TransUnion. SSN, driver’s license, passport, and financial accounts are all in scope.
4. File IRS Form 14039.
5. Cancel and reissue all payment cards that may be tied to your Alpine Lumber HR records.
6. Replace your passport if you receive evidence of identity theft using it.
7. Stop the ongoing flow of your employee group health plan data. HealthConsent files HIPAA restriction requests covering self-insured plan and cafeteria-plan administration pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches