Table of Contents
Alpine Lumber, the 21-unit Colorado and Mexico chain that was acquired last year by Builders FirstSource, is alerting employees of a data security breach involving illegally viewed personnel files.
On Dec. 22, 2025, Alpine Lumber determined that certain devices in its network were encrypted with ransomware. Upon learning of the incident, the company immediately implemented response protocols, took measures to contain the activity, launched an investigation with the support of third-party cybersecurity professionals, and notified law enforcement.
The evidence showed that between Dec. 14 and Dec. 22, an unauthorized actor viewed and obtained files stored on a file server in its network. A careful review confirmed that one or more of the files contained information maintained for employment purposes, including individuals’ names, addresses, Social Security numbers, dates of birth, and health insurance plan enrollment information. The files also may have contained individuals’ health insurance policy numbers, medical information, driver’s license numbers, passport numbers, other government-issued identification numbers, financial account information, and payment card information.
Alpine filed a breach notification letter with the Attorney General of Vermont and mailed copies of the letter to the individuals involved. The company also arranged for eligible individuals to receive a complimentary membership in a credit monitoring and identity protection service.
To ensure affected individuals did not miss the notice, Alpine posted the text to its website on Feb. 18. Within a day of the notice going live online, a raft of legal firms began disseminating the news in an effort to solicit clients for a potential class-action lawsuit.
Builders FirstSource has approximately 585 distribution and manufacturing locations in 43 states. The former Alpine Lumber locations now operate under the Builders FirstSource banner.
