DISA Global Solutions, Inc., a provider of employment background screening and compliance services, experienced a cybersecurity incident involving unauthorized access to its network from February 9 through April 22, 2024. The company reportedly discovered the incident in April 2024.
The breach affected over 3.3 million individuals. Exposed data categories include names, Social Security numbers, government-issued identification, financial account or payment information, medical information, employment history, educational background, and criminal record information. The company began sending individual notification letters and filed a breach notice with the Maine Attorney General on February 21, 2025.
DISA Global Solutions operates as a vendor and downstream-data processor for employers, meaning it held applicant, employee, and screening records for customer organizations. Multiple class action lawsuits have been filed against DISA Global Solutions, Inc. in federal courts related to this incident.