Corporation Service Company Data Breach

A ransomware group publicly listed Corporation Service Company as a victim in October 2025. CSC didn’t tell the people whose Social Security numbers and payment information were stolen until August 2026, nearly a year later.

Corporation Service Company (“CSC”), a Delaware-based registered agent and corporate-services provider, notified individuals on August 13, 2026 that an unauthorized actor had accessed a third-party-hosted database and copied files between August 10 and August 25, 2025. CSC’s notice states it learned of suspicious activity related to its network and then conducted a “comprehensive and time-consuming review” of the files at risk, which it completed on July 15, 2026.

A Ransomware Group Told the World Before CSC Told Its Customers

The breach window CSC has confirmed runs from August 10 to August 25, 2025. The Cl0p ransomware group publicly listed CSC on its dark web leak site on October 21, 2025, and CSC says it discovered the incident on October 24, 2025, three days later. Individual notice did not go out until August 13, 2026, roughly twelve months after the breach and about ten months after CSC’s own discovery date.

That gap means anyone monitoring the Cl0p group’s leak site could have learned CSC was a victim nearly a year before CSC told the people whose information was actually taken.

Sources: CSC’s own Notice of Data Event letter; SC Media, “Corporation Service Company breach exposes PII on 5,678 customers”; CyberScoop, “Hackers steal PII and payment info of thousands of California residents in company breach.”

What Information Was Exposed?

According to CSC’s notice and independent reporting, the information involved included:

• Names
• Social Security numbers (confirmed)
• Payment information

How Many People Are Affected?

CSC’s filing with the California Attorney General reports 5,678 affected individuals. CSC also reported the incident to the Vermont Attorney General. Because CSC serves as a registered agent and corporate-services provider, its affected population skews toward business owners, officers, and principals rather than typical retail consumers.

What Is CSC Offering Affected Individuals?

CSC is offering 12 months of Single Bureau Credit Monitoring, Single Bureau Credit Report, and Single Bureau Credit Score services through Cyberscout, a TransUnion company, at no cost. Enrollment is not automatic; CSC’s letter states individuals must enroll within 90 days of the August 13, 2026 letter date at bfs.cyberscout.com/activate, or call 1.866.898.4668.

Your Information Is at Risk

A confirmed Social Security number combined with payment information is enough to open new credit, attempt a fraudulent purchase, or target a person with convincing phishing messages that reference real account details. The year-long gap between the breach and notice gave any attacker a substantial head start. Affected individuals should watch financial accounts for unfamiliar activity, pull a free credit report, and consider enrolling in the credit monitoring CSC is offering before the 90-day window closes.

Do You Have Legal Options?

Companies that collect Social Security numbers and payment information have a legal duty to secure that data and to notify affected individuals without unreasonable delay. A nearly year-long gap between a public ransomware leak-site listing and consumer notice raises real questions about whether that duty was met.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review if you received a notice letter from Corporation Service Company.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

FAQ

Who is affected by the Corporation Service Company data breach?

Individuals whose information was in files an unauthorized actor accessed between August 10 and August 25, 2025. CSC’s California filing reports 5,678 affected individuals.

What information was exposed?

Names, Social Security numbers, and payment information, per CSC’s notice and independent reporting from SC Media and CyberScoop.

Why did it take almost a year to be notified?

The breach window was August 10 to August 25, 2025. The Cl0p ransomware group listed CSC on its leak site on October 21, 2025, and CSC says it discovered the incident three days later, on October 24, 2025. Notice letters weren’t sent until August 13, 2026. CSC’s letter does not explain the reason for the delay.

Is CSC paying for credit monitoring?

Yes. CSC is offering 12 months of Single Bureau Credit Monitoring, Credit Report, and Credit Score access through Cyberscout at no cost, but you must enroll within 90 days of the letter date; CSC does not enroll people automatically.

I’m not a direct CSC customer. Why would my information be involved?

CSC acts as a registered agent and corporate-services provider for a large number of businesses nationwide. If you are an officer, principal, or contact person for a company that used CSC’s services, your personal information may have been held in CSC’s systems even if you never dealt with CSC directly.

Do I have a legal claim?

Companies that collect Social Security numbers and payment information have a legal duty to secure that data and to notify affected individuals without unreasonable delay. If you received a notice from Corporation Service Company, contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.