Robinson Nursery 2026 Data Breach

The primary source is Robinson Nursery's “Notice Regarding Data Security Incident” PDF on its own website. It directly describes the access period, removal of files by an unauthorized third party, June 10 forensic finding, exact data categories, notifications beginning July 10, and the assistance line at 1-888-289-7169.

The company's official website separately verifies the organization's identity and publication of the notice on its domain. Claim Depot links the official document to the organization profile and summarizes the dates and data types. The sources align on the core facts. A secondary report of an Akira claim remains separate because the company notice provides no confirmed actor attribution.

Robinson Nursery said an unauthorized party accessed certain systems in its network environment from about February 22 through February 23. The forensic review determined that files were removed from the network around February 23. This was not merely possible viewing: the primary company document confirms file removal. The company said it contained the threat after learning of the issue.

The sources do not disclose whether initial access involved phishing, a compromised account, remote access, or a software vulnerability. Claim Depot reports that a group called Akira claimed responsibility on March 11, but the official company document confirms no actor, ransom demand, or leak site. The claim is not recorded as a technical root cause or definitive attribution.

Identity categories were full name, date of birth, SSN, passport number, taxpayer-identification number, and driver's-license number. Financial-account information could also appear in the removed files. This combination creates substantial risk of fraudulent account opening, tax fraud, account takeover, and highly credible targeted phishing.

The sources do not separately confirm a bank name, routing number, balance, payment card, CVV, PIN, email address, or password. “Financial account information” is a broad category and should not be expanded into undocumented subfields. Because the combination varied by person, a recipient should rely on the field list in the individual notice.

Health-insurance information and medical-treatment information appear explicitly in the official list. These fields create exposure to medical identity theft, fraudulent insurance claims, unfamiliar provider activity, and social engineering based on treatment context. The company said it had no indication of fraud resulting from the incident.

The notice does not separately list diagnoses, prescriptions, laboratory results, medical-record numbers, clinician names, insurance member numbers, or complete clinical files. Assigning undocumented detail to everyone would overstate the confirmed scope.

Robinson Nursery began notifying people on July 10 whose information was in files that may have been removed, but it published no national population total. Employee, customer, vendor, or file volumes are not victim counts. The organization did not publish a verifiable affected-person or record total. An undisclosed count does not mean the incident had no impact; it means the public sources do not provide a reliable total.

The company contained the threat, conducted a comprehensive review with outside specialists, and said it was taking steps to augment existing cybersecurity practices. Recipients received information-protection guidance. The dedicated response line remains available for 90 days after notice, weekdays from 9 a.m. to 9 p.m. Eastern Time, excluding holidays.

If an SSN, taxpayer ID, passport, or license number was involved, consider credit freezes, a fraud alert, an IRS IP PIN, and monitoring for document misuse. For financial-account information, review transactions, new payees, and contact changes. For health data, inspect insurance benefit statements and unfamiliar provider or treatment records.

Criminals may use the employer, nursery, insurer, or bank name in fake payroll, tax, benefit, or account-update messages. Independently open the organization's and financial institution's official channels instead of following an inbound link. Do not share a full SSN, password, bank verification code, or one-time code merely because a caller knows a real affected field.