DISA Global Solutions, a leading U.S.-based employee screening service provider, has announced a significant data breach impacting over 3.3 million individuals.

The company, known for offering services such as drug and alcohol testing, background checks, and more to over 55,000 businesses—including a third of the Fortune 500 companies—revealed the breach in an official filing with Maine’s attorney general on Monday.

The breach was first detected on April 22, 2024, when DISA reported a “cyber incident” that affected a small part of its network. However, an internal investigation uncovered that the hacker gained access to DISA’s network as early as February 9, 2024, and remained undetected for over two months.


In letters sent to those impacted, DISA disclosed that the attacker accessed certain information from their systems. The company later confirmed to the Massachusetts attorney general that the stolen data included sensitive details such as Social Security numbers, credit card information, and government-issued IDs. As of now, over 360,000 residents of Massachusetts are confirmed to be affected by the breach.

Despite these revelations, DISA stated in its breach notification letter that it “could not definitively conclude the specific data accessed,” suggesting a lack of sufficient logging tools or other means to precisely track the stolen data. This lack of clarity raises concerns about the full extent of the breach.

DISA collects extensive personal and sensitive data, such as applicants’ work history, educational background, criminal records, and credit histories. While the breach’s full impact is still under investigation, it is clear that the attacker had access to a wide range of private information.

READ
North Korean Hackers Steal $1.5 Billion in Biggest Crypto Heist Ever

At this time, it remains unknown who was responsible for the cyberattack or how DISA’s network was compromised. Additionally, questions have arisen about why it took DISA so long to notify the affected individuals. The company’s delayed response continues to raise concerns about its data protection measures.

For now, the focus remains on identifying the attackers and minimizing further damage while ensuring better safeguards against future breaches.