VeriSource confirms that last year’s data breach impacted millions

VeriSource, a Texas-based employee benefits administration firm, has reported that the February data breach has compromised the personal information of at least 4 million individuals.

This affected company is known for providing HR outsourcing and employee benefits administration to various clients across the United States.

Reports show that the firm started notifying the affected parties about a cybersecurity incident in February 2024. However, the company took until April 2025 to assess the issue fully.

 

The VeriSource investigation uncovered that the threat actors had compromised sensitive information during the attack.

 

According to the VeriSource investigation, its sensitive information was exposed to external threat actors. On February 28, 2024, the notice shared with authorities stated that VSI detected unusual activity disrupting access to specific systems. Upon discovering this, the entity quickly acted to secure its network and enlisted an external digital forensics and incident response provider to investigate the situation and ascertain any potential data breaches.

The investigation later indicated that an unidentified actor may have unlawfully accessed some personal data on February 27, 2024.

The process of identifying those whose information was compromised concluded on April 17, 2025, and breach notifications were sent out on April 23.

In the sample provided to Maine’s Attorney General’s office, potentially affected data include employees’ full names, addresses, dates of birth, genders, and Social Security numbers.

VeriSource is providing affected customers with one-year credit monitoring, identity protection provisions, and identity restoration services.

It is important to note that VeriSource previously attempted to notify impacted individuals, sending letters to 55,000 people in May 2024 and another 112,000 in September 2024. Still, these totals are significantly lower than the newly disclosed figure of 4 million.

Despite the delay, customers who have received a notification from VeriSource should still utilise and enrol in the offered credit and identity protection services promptly to avoid potential risks caused by the data breach.

Affected individuals must also be cautious when engaging with unsolicited communications and remain alert for phishing attacks. The company has not yet been seen on any listings for ransomware extortion or on dark websites. Therefore, the precise nature and scope of the cybersecurity issue remain a mystery.