VeriSource Services Inc. experienced a cyberattack that began around February 27–28, 2024. The company detected unauthorized activity at this time.
The breach ultimately affected approximately 4 million individuals, primarily employees and dependents of client organizations for whom VeriSource acted as an HR and employee-benefits service provider. The exposed data included names, addresses, dates of birth, gender information, and government identification numbers, including Social Security numbers. Litigation also described the alleged exposure of private health information, though the specific medical fields involved are not fully detailed. There is no reliable source confirming the exposure of bank account, payment card, or other traditional financial account data.
VeriSource offered 12 months of credit monitoring and identity-protection services to affected individuals. The company stated it had not identified evidence of misuse, though the exact wording of this statement is not publicly available. California's Attorney General breach database lists multiple notices for this incident, with notification dates ranging from August 20, 2024, to April 25, 2025.