Corporation Service Company (CSC) experienced a data breach that was the result of a ransomware attack. The hacking group CL0P claimed responsibility for the breach and posted about it on the Tor network on October 21, 2025. The company confirmed the incident to the Vermont Attorney General's office on August 13, 2026, stating that systems were compromised and sensitive data was accessed.
Confirmed data types exposed include names, Social Security numbers, dates of birth, addresses, and government IDs. The exposure of medical and financial information is possible but not yet publicly confirmed. The exact number of affected individuals has not been disclosed, and only the Vermont Attorney General filing is currently confirmed for states affected.
A law firm is actively investigating the incident for a potential class action lawsuit. Details regarding the full scope of the incident, including specific affected counts and notification letters, have not yet been publicly posted. Further details may emerge as investigations proceed and more official notices are released.