{
  "id": "essg-staffing-files",
  "url": "https://ohshit.app/incidents/essg-staffing-files/",
  "title": "Employer Solutions Staffing Group reports unauthorized access to sensitive files",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-12",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Data breach",
    "Personal information"
  ],
  "ecosystems": [],
  "summary": "Employer Solutions Staffing Group says files were accessed or acquired without authorization in January. Notices published in November identify sensitive identity, financial and health data. Affected people should verify their notice and check its monitoring deadline.",
  "splash": "People identified in affected Employer Solutions Staffing Group files and notified about the incident.",
  "wipe": "Verify your notice, enroll in offered monitoring by the stated deadline and check accounts for misuse.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify the notice and enrollment details",
      "hint": "Use the California-filed notice to find the IDX portal or call 1-877-201-3335. Use the personal enrollment code and check your letter for the service duration. The sample gives February 12, 2027 as the deadline."
    },
    {
      "title": "Check records for identity or account misuse",
      "hint": "Review bank statements and credit reports. Report unknown transactions to your financial institution; consider a freeze at each major credit bureau if identity documents were involved. Review insurance statements if health data was listed."
    }
  ],
  "sources": [
    {
      "name": "ESSG sample notice filed in California",
      "url": "https://oag.ca.gov/system/files/Employer%20Solutions%20Staffing%20Group%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf",
      "says": "Documents the dates, response, contact and monitoring enrollment.",
      "primary": true
    },
    {
      "name": "Vermont Attorney General notice register",
      "url": "https://ago.vermont.gov/categories/security-breach-notices?page=3",
      "says": "Lists 43 Vermont residents and the reported data categories.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The company confirmed unauthorized access or acquisition of certain files.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Jan 13, 2026",
      "title": "ESSG detects suspicious network activity",
      "body": "The investigation dates unauthorized access or acquisition of some files to this day."
    },
    {
      "date": "Oct 13, 2026",
      "title": "File review identifies personal information",
      "body": "ESSG determines the affected files include personal information about certain people."
    },
    {
      "date": "Nov 12, 2026",
      "title": "ESSG issues breach notices",
      "body": "California publishes the company’s sample notice and Vermont lists 43 affected residents."
    }
  ],
  "body_markdown": "The company says it secured its network, reviewed the files and notified law enforcement. The sample letter does not give the initial access method, a national victim count or the data fields for an individual. Vermont’s register lists Social Security numbers, government ID numbers, financial account codes, payment account information and health records. The Vermont count applies to that state. The fields in an individual letter determine which precautions apply."
}