VeriSource Services, a company that manages employee benefits and HR administration, has announced a major data breach that impacts approximately four million people. The exposed data includes names, addresses, dates of birth, gender, and Social Security numbers—sensitive information that can be used in identity theft.
When and How It Happened
- Date of breach: February 27, 2024
- Discovered: February 28, 2024 (the very next day)
- Data review completed: August 12, 2024
- Notification process finalized: April 17, 2025
VeriSource says a threat actor (unauthorized party) accessed and stole data from their systems. While there’s no evidence yet that the stolen data has been misused, the risk is significant due to the type of information involved.
Who’s Affected?
The breach involves:
- Employees and dependents of companies that use VeriSource’s HR and benefits services
- Individuals whose personal data was managed by VeriSource on behalf of employers
The company worked closely with affected businesses to identify and notify all impacted people. Notifications began shortly after the internal review was completed.
What’s Being Done?
To support affected individuals, VeriSource is offering:
- 12 months of free credit monitoring and identity protection services
- A recommendation to carefully check bank and credit card statements for suspicious activity
They also advise anyone impacted to report anything unusual to their financial institutions immediately.
About VeriSource
Founded in 1997 and based in Houston, Texas, VeriSource provides a wide range of HR and employee benefits solutions—including:
- Benefits enrollment
- Data management
- ACA (Affordable Care Act) compliance reporting
- FMLA (Family and Medical Leave Act) administration
- Dependent verification and billing support
What This Means for Employers and IT Professionals
This breach is a clear reminder of the importance of:
- Rapid incident detection and response
- Data classification and access controls
- Regular system audits and penetration testing
- Having a strong vendor risk management plan in place
Organizations that outsource sensitive employee data must ensure their partners have robust cybersecurity measures. Even well-established service providers can become targets—and vulnerabilities can go unnoticed for long periods.