UPS Store

Disclosed Nov 26, 20196 years ago17,094 affectedConfirmed

What is known

People affected	17,094 (as reported by the organization)
Disclosed	Nov 26, 2019
Discovered	Dec 18, 2019
Happened	Sep 29, 2019
Attack	Phishing
Data exposed	Names, Social Security numbers, Payment cards, Financial, Government IDs
Sector	Retail · US
Status	Confirmed

Source	Kind
California Attorney General breach notice: UPS Storeoag.ca.gov · Official notice	Official notice
Washington Attorney General breach notice: UPS Storeatg.wa.gov · Official notice	Official notice
Indiana Attorney General 2020 data breach report: UPS Storein.gov · Official notice	Official notice
Indiana Attorney General 2019 data breach report: UPS Storein.gov · Official notice	Official notice
Maine Attorney General breach notice archive: UPS Storemaine.gov · Official notice	Official notice

Where	Filed	People
Washington AGresidents of WA	Nov 26, 2019	506
California AGresidents of CA	Nov 27, 2019
Indiana AGresidents of IN	Nov 27, 2019	550
Maine AGresidents of ME	Nov 27, 2019	3
California AGresidents of CA	Jan 20, 2020
Washington AGresidents of WA	Jan 20, 2020	963
Indiana AGresidents of IN	Jan 21, 2020	300
Maine AGresidents of ME	Jan 21, 2020	2

Breach	Disclosed	Attack	Sector	Status	Affected
Malware at 51 UPS Store franchises exposes customer card dataAug 20, 201412 years agoHacking	Aug 20, 201412 years ago	Hacking	Retail	Confirmed	Unknown

History of this record

2026-09-25 · data_types: ["names","ssn","payment-card","financial"] to ["names","ssn","payment-card","financial","government-id"] · backfill source
2026-09-25 · data_types: [] to ["names","ssn","payment-card","financial"] · backfill source
2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DecDataBreach.pdf · backfill source
2026-09-25 · records_basis: empty to organization · backfill source
2026-09-25 · records: empty to 17094 · backfill source
2026-09-25 · disclosed: 2019-11-27 to 2019-11-26 · backfill source
2026-09-25 · attack: unknown to phishing · backfill source
2026-09-25 · discovered: empty to 2019-12-18 · backfill source
2026-09-25 · disclosed: 2020-01-20 to 2019-11-27 · backfill source
2026-09-25 · added · backfill source

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.