VeriSource Services
Disclosed Aug 20, 20242 years ago4,000,000 affectedConfirmed
VeriSource says February 2024 breach exposed data of 4 million people
Benefits administrator VeriSource said an unknown actor acquired personal data around February 27, 2024, and after a review completed April 17, 2025 began notifying about 4 million people; data included names, addresses, birth dates and SSNs.
What is known
| People affected | 4,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Aug 20, 2024 |
| Discovered | Feb 28, 2024 |
| Happened | Feb 28, 2024 |
| Attack | Hacking |
| Data exposed | Names, Addresses, Dates of birth, Social Security numbers, Employment, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: VeriSource Servicesoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: VeriSource Servicesatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: VeriSource Servicesattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: VeriSource Servicesjustice.oregon.gov · Official notice | Official notice |
| VeriSource now says February data breach impacts 4 million peoplebleepingcomputer.com · News | News |
| Vermont Attorney General: 2025-04-23 VeriSource Services Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Vermont Attorney General: 2024-08-21 VeriSource Services Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): VeriSource Services (Business Associate, TX)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Aug 20, 2024 | |
| HHS archivetotal | Aug 20, 2024 | 112,726 |
| Vermont AGresidents of VT | Aug 21, 2024 | |
| California AGresidents of CA | Nov 6, 2024 | |
| Delaware DOJresidents of DE | Apr 23, 2025 | 10,682 |
| Researchtotal | Apr 23, 2025 | 4,000,000 |
| Vermont AGresidents of VT | Apr 23, 2025 | |
| California AGresidents of CA | Apr 25, 2025 | |
| Washington AGresidents of WA | Apr 25, 2025 | 85,880 |
| Oregon DOJresidents of OR | Apr 26, 2025 | 4,052,972 |
History of this record
- 2026-09-25 · data_types: ["names","addresses","dob","ssn","employment"] to ["names","addresses","dob","ssn","employment","health"] · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2024-08-21-verisource-services-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-04-23-verisource-services-data-breach-notice-consumers · backfill source
- 2026-09-25 · attack: ransomware to hacking · seed source
- 2026-09-25 · data_types: ["names"] to ["names","addresses","dob","ssn","employment"] · seed source
- 2026-09-25 · summary: empty to Benefits administrator VeriSource said an unknown actor acquired personal data around February 27, 2024, and after a review completed April 17, 2025 began notifying about 4 million people; data included names, addresses, birth dates and SSN · seed source
- 2026-09-25 · title: empty to VeriSource says February 2024 breach exposed data of 4 million people · seed source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 4000000 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2024-02-28 · backfill source
- 2026-09-25 · disclosed: 2024-11-06 to 2024-08-20 · backfill source
- 2026-09-25 · disclosed: 2025-04-25 to 2024-11-06 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.