Data Security Notice

NOTICE

Multi-Color Corporation STATEMENT ON DATA SECURITY INCIDENT

Date: October 22, 2022

At Multi-Color Corporation (“MCC”) we value our customers and employees and understand the importance of protecting your personal information. Unfortunately, we regret to inform you that we were the victim of a cyberattack.

On September 29, 2022, MCC identified unusual activity occurring within our information networks and systems and discovered that a third party had unauthorized access to our information technology environment. MCC immediately deployed security measures to contain and mitigate the threat and retained an external incident response team to accelerate our mitigation efforts. Because of the substantial security controls that MCC implemented prior to the cybersecurity incident, we were able to quickly contain the threat.

However, as part of our investigation, we discovered that the perpetrator of the cyberattack accessed MCC files and records, including proprietary data and sensitive personal information related to our employees. MCC collected and retained this personal information to administer our health and wellness program, facilitate payroll, and complete other routine business functions. Unfortunately, there is evidence that personal information related to a limited number of employees’ spouses, partners, and/or dependents enrolled in our benefits programs was also compromised. Based on the measures that we have implemented and the actions we have taken, there is no indication that any such personal information subject to this cybersecurity incident has been misused or will be misused in the future.

However, out of an abundance of caution, MCC is providing complimentary credit monitoring and identity theft services to those individuals who have been impacted by this cybersecurity incident.

• Current MCC Employees. If you are currently a MCC employee as of the date of this notice, and your sensitive personal information was impacted by this cybersecurity incident, then you will receive a separate notice (e.g., mail, email) that describes this incident and your ability to enroll in our complimentary credit monitoring and identity theft protection services. If you do not receive such a separate notice, then we do not have any reason to believe that your sensitive personal information was compromised by this incident.
• Former MCC Employees. If you were previously employed by MCC prior to the date of this notice, you may be eligible to enroll in our complimentary credit monitoring and identity theft services. Please inquire (through the “Contact Information” section below) as to whether sensitive personal information related to you or your family members was subject to this incident and whether you are eligible to enroll in these complimentary credit monitoring and identity theft services. To be clear, we are extending our complimentary credit monitoring and identity theft protection services to any immediate family members of MCC employees who were impacted by this cybersecurity incident.
• MCC Customers and Suppliers. Please note that MCC generally does not retain sensitive personal data on our customers or suppliers, and there is no evidence at this juncture that such personal information was involved in this incident. If you are a customer or supplier of MCC, and you believe we retain your sensitive personal data, please contact us immediately.

Contact Information. We have established a dedicated call center to answer questions you may have about this incident.

• For United States residents: contact 888-291-2363, available Monday – Friday, 9:00 am to 9:00 pm EST.
• For non-United States residents: contact +44(0)330 053 3818, available 24/7.

Other Resources. Please see this additional information sheet that describes other personal information safeguards and programs that may be available to you. 

Frequently Asked Questions (FAQ). Please see our FAQ  that seeks to address questions about this incident, including information on how to enroll in our complimentary credit monitoring and identity theft services.

Source: Multi-Color Corporation, 4053 Clough Woods Drive, Batavia, OH 45103.