Cardinal Services Data Breach Exposes Sensitive Information of Over 142,000 Individuals
Shamis & Gentile P.A., a class action law firm specializing in data breach cases, is investigating a cybersecurity incident involving Cardinal Services, Inc., an HR outsourcing and employment services company based in Coos Bay, Oregon.
The breach, discovered by Cardinal on May 12, 2026, occurred between June 25 and August 8, 2025, when an unauthorized party accessed sensitive consumer data. The RHYSIDA ransomware group claimed responsibility, threatening to publish stolen information on the dark web after posting details on July 15, 2025.
Affected data includes Social Security numbers, financial account codes, credit/debit card details, and government ID numbers, impacting 142,323 individuals across the U.S., including residents of Maine and Vermont. Cardinal began notifying affected consumers in writing on May 20, 2026.
Founded in 1984, Cardinal provides staffing, payroll processing, HR administration, and risk compliance services to businesses in the Pacific Northwest. The incident highlights ongoing risks associated with third-party data handling and ransomware attacks.
Source: https://www.claimdepot.com/investigations/cardinal-services-data-breach-2026
Cardinal Services, Inc. cybersecurity rating report: https://www.rankiteo.com/company/cardinalservices
"id": "CAR1779395903",
"linkid": "cardinalservices",
"type": "Ransomware",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '142,323 individuals',
'industry': 'Human Resources, Staffing, Payroll '
'Processing',
'location': 'Coos Bay, Oregon, USA',
'name': 'Cardinal Services, Inc.',
'type': 'HR outsourcing and employment services '
'company'}],
'customer_advisories': 'Written notifications sent to affected consumers on '
'May 20, 2026',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '142,323',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Social Security numbers, '
'financial account codes, '
'credit/debit card details, '
'government ID numbers'},
'date_detected': '2026-05-12',
'date_publicly_disclosed': '2026-05-20',
'description': 'A cybersecurity incident involving Cardinal Services, Inc., '
'an HR outsourcing and employment services company, where an '
'unauthorized party accessed sensitive consumer data. The '
'RHYSIDA ransomware group claimed responsibility and '
'threatened to publish stolen information on the dark web.',
'impact': {'data_compromised': 'Social Security numbers, financial account '
'codes, credit/debit card details, government '
'ID numbers',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'initial_access_broker': {'data_sold_on_dark_web': 'Threatened'},
'investigation_status': 'Ongoing',
'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'RHYSIDA'},
'references': [{'source': 'Shamis & Gentile P.A.'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation by '
'Shamis & Gentile P.A.'},
'response': {'communication_strategy': 'Written notifications to affected '
'consumers'},
'threat_actor': 'RHYSIDA ransomware group',
'title': 'Cardinal Services Data Breach Exposes Sensitive Information of Over '
'142,000 Individuals',
'type': 'Data Breach, Ransomware'}