FEDERALItem 1.05 · mandatoryUnauthorized AccessManufacturingHealthcareManufacturingMedical InstrumentsData ExfiltratedData DestroyedLowContained

UFP TECHNOLOGIES, INC.

bd_891a6c15083fb194 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 14, 2026

Filed

Feb 24, 2026

To disclose

10 days

Affected

Not disclosed

Linked

3 records

Confidence

73%

Full breach record for UFP TECHNOLOGIES, INC. →

UFP Technologies, Inc. (NASDAQ: UFPT) detected suspicious activity on its IT systems on or about February 14, 2026. The company isolated affected systems, engaged external cybersecurity advisors, and believes the third party has been removed. Billing and label-making functions were impacted; certain company-related data appears to have been stolen or destroyed. Investigation continues into whether personal information was exfiltrated. The company does not believe the incident is reasonably likely to materially impact financial condition.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined Feb 19, 2026 → Filed Feb 24, 20265d ✓ SEC 4-day OK10 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 10 days

Feb 14, 2026

Discovered

Feb 19, 2026

Scope determined

Feb 24, 2026

Filed

This filing is one of 3 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepayoutskingbd_fde42440c341ad4a2026-02-19 · +5dVerified by operator

Press reports (1)

Presspayoutskingbd_13f59b6d0763a7ac2026-02-14 · +10dCandidate

Name: UFP TECHNOLOGIES, INC.
norm: ufp technologies
SEC CIK: 0000914156
Domain: ufpt.com

Name: UFP TECHNOLOGIES, INC.
norm: ufp technologies
SEC CIK: 0000914156
Domain: ufpt.com
Industry: ManufacturingllmHealthcarellm
NAICS 339112 · Surgical and Medical Instrument Manufacturing

Discovered: Feb 14, 2026
Materiality determined: Feb 19, 2026
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1485 Data Destruction
Threat actor: External

During the incident: Began taking steps to assess, contain, and remediate the unauthorized activity
Isolating the affected systems
Launching an investigation with the assistance of external cybersecurity advisors
Implemented planned solutions for the issues posed by the incident
Evaluating what legal and regulatory notifications and filings may be required
Changes made: Removed the third party responsible from the Company's IT systems
Restored ability to access information impacted by this incident
Activated contingency plans and data backup systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: SEC 4-day OK · 5d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: Feb 19, 2026
→ Filed: Feb 24, 2026
5d cal. 4 business days SEC 4-day OK

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: Feb 19, 2026 → Filed: Feb 24, 2026	5d cal.	4 business days	SEC 4-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/914156/000162828026011152/ufpt-20260219.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 24, 2026
Raw hash: 33227496d1b3e91146dcf5010373f004c27fd39aec774c6b4a3c5c2e58d04b5d

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html26.9 KB

Download View at source

Linked disclosures

Ransomware claims (1)

Press reports (1)

Reporting entityUFP TECHNOLOGIES, INC.

Victim entityUFP TECHNOLOGIES, INC.

Incidentdiscovered Feb 14, 2026

Stated responseBegan taking steps to assess, contain, and remediate the unauthorized activity

ComplianceSEC 4-day OK

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing