NBCUniversal employee data breach lawsuit (Johnston v. NBCUniversal Media LLC)

A former NBCUniversal employee filed a proposed class action in Manhattan federal court on October 24, 2026. He says hackers stole and then leaked employee records from the media company, including payroll and identity information. The case is Johnston v. NBCUniversal Media LLC, No. 1:26-cv-09324, in the U.S. District Court for the Southern District of New York.

One point matters most for readers. NBCUniversal has not publicly confirmed a breach, and the complaint itself says the company has not confirmed one. No notice letters have been found, no court has ruled and there is no settlement. This page explains what the lawsuit claims and what is still unverified.

The defendant is NBCUniversal Media, LLC. The complaint describes it as a New York company with its main office at 30 Rockefeller Center in Manhattan. Comcast's 2025 annual report describes NBCUniversal's businesses inside Comcast, including the NBC and Telemundo networks, the Peacock streaming service, Universal Pictures and Universal theme parks.

The plaintiff is David Johnston, who lives in Hampden County, Massachusetts. The complaint says he is a former NBCUniversal employee and, "upon information and belief," that his personal information was compromised. That phrase means he believes it but does not yet have direct proof. His lawyer is Blake Hunter Yagman of Yagman PLLC in New York.

The complaint names a hacking group it calls ScarlettGroup as the attacker. The group is not a party to the case.

These events come from the complaint and one news report. NBCUniversal has not given its own account.

• October 18, 2026: the complaint says ScarlettGroup posted on a dark web forum that it had NBC's internal data and invited the company to negotiate a ransom.
• October 19, 2026: Cybernews reported that a threat actor had posted samples on a hacker marketplace. Its researchers found recent-looking files referencing Universal Television, including production plans, budgets and tax credit applications. Cybernews said it could not verify the seller's claims about access to customer management systems or email, and that it had contacted the company for comment.
• October 23 or 24, 2026: the complaint says the group released the full set of files. It says, citing online reporting, that the files included employee records, payroll information, timecards, talent roles, financial and tax documents, and Salesforce business records.

The complaint says the intrusion happened between September and October 2026. It lists the types of employee information NBCUniversal collects as names, financial account information, tax identification numbers, Social Security numbers, payment card information and driver's license numbers.

The Cybernews report Class Action Pulse reviewed describes studio business documents. It does not say that employee Social Security numbers or payroll records were in the samples it saw. That claim comes from the complaint.

The complaint says NBCUniversal failed to protect employee data and failed to warn workers. In particular, it says the company:

• did not use reasonable security, such as encrypting sensitive files;
• has not confirmed the breach or told employees their information may be exposed;
• has not offered credit monitoring or any other help; and
• has not explained how the attack happened or what it is doing about it.

It brings two legal claims, breach of implied contract and negligence, including negligence per se. These are accusations, not findings.

NBCUniversal has not filed a response, and Class Action Pulse did not find any public statement from the company about the alleged breach. Until the company speaks or files in court, its side is unknown.

The court has decided nothing. The docket shows the complaint filed on October 24, 2026, with a jury demand. The docket data Class Action Pulse reviewed did not show an assigned judge.

No judge has found that a breach occurred, that NBCUniversal was careless or that any worker was harmed. No class has been certified.

The complaint proposes one class: all individuals in the United States whose personal information was compromised in the data breach that affected NBCUniversal's data in September 2026. It excludes NBCUniversal, its affiliates, officers and directors, and the judges on the case and their families.

That definition depends on facts no one has confirmed yet, including whether a breach happened and whose data was taken. Current and former NBCUniversal employees appear most likely to be affected based on the complaint's description of the files.

The size of the group is unclear. The complaint says NBC has more than 35,000 employees. Elsewhere it says the company reported that up to 35,000 current and former employees were affected, even though it also says the company has not confirmed the breach. Class Action Pulse found no company report of an affected count, so treat 35,000 as a workforce estimate, not a confirmed number of victims.

• If you work or worked for NBCUniversal, watch your mail and email for any official notice from the company.
• Consider a free credit freeze with Equifax, Experian and TransUnion. It blocks new accounts opened in your name.
• Check your credit reports at AnnualCreditReport.com and review bank and payroll deposit accounts.
• If you are worried about tax fraud, ask the IRS for an Identity Protection PIN.
• Be careful with calls, texts or emails that mention the breach and ask for information or payment.
• Keep records of any fraud, time spent or costs. They could matter if the case moves forward.

Nothing is available now. The complaint asks for actual, compensatory, statutory, nominal and punitive damages where the law allows them. It also asks for court orders requiring stronger security, yearly security audits and credit monitoring for class members. Those are requests. Any payment would require a win at trial or a court approved settlement.

• September to October 2026: period when the complaint says the breach happened.
• October 18, 2026: alleged dark web post by ScarlettGroup.
• October 19, 2026: Cybernews report on the posted samples.
• October 23 or 24, 2026: alleged release of the full file set.
• October 24, 2026: Johnston v. NBCUniversal Media LLC filed.

There is no claim deadline because there is no settlement. Time limits for data breach claims depend on state law and the legal theory.

• Proposed class action: a lawsuit filed for a group that a judge has not yet approved as a class.
• Breach of implied contract: a claim that an employer, by collecting personal data as a condition of work, implicitly promised to protect it.
• Negligence per se: a claim that a company was careless because it broke a law or rule meant to protect people like the plaintiff.
• Dark web forum: a hidden website, often used to trade stolen data, that ordinary search engines do not index.
• Credit freeze: a free block that stops new credit from being opened in your name.

NBCUniversal will have a set time to respond to the complaint, often with a motion to dismiss. Other workers may file similar suits, which could be combined. If the company confirms a breach, state attorney general filings and notice letters could show how many people were affected and what data was involved. This page will be updated when that happens.

The lawsuit facts come from the filed complaint and docket. The October 19 report comes from Cybernews, and company background comes from Comcast's annual report. NBCUniversal has not confirmed a breach, and no regulator notice or notice letter was found. The data types, the leak timeline and the affected count are allegations. Class Action Pulse did not view any leaked files and does not link to the forum.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.