Cardinal Services Data Breach Exposes Personal Information, Prompts Class Action Investigation
On June 30, 2025, Cardinal Services, Inc. along with its affiliates Cardinal Employer Organization and Preferred Employer Solutions detected unauthorized access to its computer network. A subsequent investigation, completed by May 12, 2026, revealed that sensitive personal data was accessed or exfiltrated during two distinct periods: June 25–26, 2025, and August 8, 2025.
The exposed information includes names and other personal data, though specific details beyond this have not been disclosed. Individuals who received a breach notification from Cardinal may now face heightened risks of identity theft and fraud.
Edelson Lechtzin LLP, a national class action law firm, has launched an investigation into potential legal claims on behalf of affected individuals. The firm is offering free case evaluations to assess eligibility for a class action lawsuit. Cardinal Services, based in Coos Bay, Oregon, provides PEO, staffing, and HR services through its affiliated businesses.
The incident underscores ongoing vulnerabilities in third-party data security, particularly for organizations handling sensitive employee and client information. No further details on the breach’s origin or the number of impacted individuals have been released.
Cardinal Services, Inc. of Indiana cybersecurity rating report: https://www.rankiteo.com/company/cardinal-services-inc.-of-indiana
Advanced Employment Services, Inc. cybersecurity rating report: https://www.rankiteo.com/company/advanced-employment-services
"id": "CARADV1779510288",
"linkid": "cardinal-services-inc.-of-indiana, advanced-employment-services",
"type": "Breach",
"date": "6/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'PEO, Staffing, and HR Services',
'location': 'Coos Bay, Oregon',
'name': 'Cardinal Services, Inc.',
'type': 'Company'},
{'industry': 'PEO, Staffing, and HR Services',
'location': 'Coos Bay, Oregon',
'name': 'Cardinal Employer Organization',
'type': 'Affiliate'},
{'industry': 'PEO, Staffing, and HR Services',
'location': 'Coos Bay, Oregon',
'name': 'Preferred Employer Solutions',
'type': 'Affiliate'}],
'customer_advisories': 'Breach notifications sent to affected individuals',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (names and other personal data)',
'type_of_data_compromised': 'Personal information'},
'date_detected': '2025-06-30',
'date_resolved': '2026-05-12',
'description': 'Cardinal Services, Inc. and its affiliates detected '
'unauthorized access to its computer network, leading to the '
'exposure of sensitive personal data. The breach occurred '
'during two distinct periods, and affected individuals may '
'face heightened risks of identity theft and fraud. A class '
'action investigation has been launched by Edelson Lechtzin '
'LLP.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'data breach and class action '
'investigation',
'data_compromised': 'Personal information (names and other '
'personal data)',
'identity_theft_risk': 'Heightened risks of identity theft and '
'fraud',
'legal_liabilities': 'Potential class action lawsuit',
'systems_affected': 'Computer network'},
'investigation_status': 'Completed',
'lessons_learned': 'Ongoing vulnerabilities in third-party data security, '
'particularly for organizations handling sensitive '
'employee and client information.',
'references': [{'source': 'Edelson Lechtzin LLP'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation '
'launched'},
'response': {'communication_strategy': 'Breach notifications sent to affected '
'individuals',
'third_party_assistance': 'Investigation completed by external '
'party'},
'title': 'Cardinal Services Data Breach Exposes Personal Information, Prompts '
'Class Action Investigation',
'type': 'Data Breach'}