Major Cybersecurity Breach Exposes Records of 4,000,000 Americans – Firm Says Unknown Actor May Have Acquired Names, Addresses and Social Security Numbers

Millions of Americans are now staring at the possibility of identity theft and privacy violations after a massive cybersecurity incident at an employee benefits administration firm.

In a new filing with the Office of the Maine Attorney General, Houston-based VeriSource Services Inc. (VSI) says it has detected a significant data breach affecting four million individuals.

The firm says its investigation revealed that an unknown actor accessed its database without authorization and compromised customer records, including names, addresses, dates of birth, Social Security numbers and genders.

“On February 28, 2024, VSI became aware of unusual activity that disrupted access to certain systems.

Upon discovery, VSI immediately took steps to secure its network and engaged a leading, independent digital forensics and incident response firm to investigate what happened and whether any sensitive data may have been impacted. The investigation subsequently revealed certain personal information may have been acquired without authorization by an unknown actor on or about February 27, 2024. VSI undertook a comprehensive review of the potentially impacted data to identify the individuals and information involved…

That process was completed on April 17, 2025.” 

VSI offers employee administrative and benefit data management services for companies, including Consolidated Omnibus Budget Reconciliation Act (COBRA) administration, dependent verification, Affordable Care Act (ACA) reporting, eligibility monitoring, direct billing services and more.

The firm says it immediately sent letters of notification to impacted customers while offering identity theft protection services that come with dark web monitoring and a $1 million insurance reimbursement policy.

For now, VSI says it has not seen “evidence of any actual or suspected misuse of information involved in this incident.”

The firm also says it reported the incident to the FBI and revamped its security protocols to reduce the risk of witnessing a similar cybersecurity incident in the future.

Generated Image: Midjourney