GardaWorld Data Breach

The Qilin ransomware group says it attacked GardaWorld, a global security and armored-car company. GardaWorld has not confirmed the claim, and no one has been told their information was involved.

What Qilin Claims About GardaWorld

On October 19, 2026, Qilin added GardaWorld (garda.com) to its leak site, according to the threat-tracking service ransomware.live. A leak site is a website where a criminal group lists the companies it says it attacked. Groups use these sites to pressure companies into paying.

Qilin, also known as Agenda, runs a ransomware-as-a-service operation. That means the group rents its tools to other hackers, who carry out attacks and split any ransom. Ransomware is software that locks a company’s files and often copies them first.

The listing names the global GardaWorld brand. It does not make clear which GardaWorld business, or which country’s records, the claim involves. Qilin has claimed it attacked GardaWorld; GardaWorld has not confirmed.

What GardaWorld Has Said So Far

As of October 20, 2026, GardaWorld has not made a public statement about the claim. Emery | Reddy found no notice letters, no state Attorney General filings and no company website notice tied to this listing.

That means several key facts are still unknown:

• Whether a data breach actually happened
• Which GardaWorld company or country is involved
• Whether any personal information was taken
• How many people, if any, are affected

Emery | Reddy will update this post if GardaWorld confirms an incident or begins sending notices.

Who Could Be Affected If the Claim Is Confirmed

GardaWorld is based in Montreal and provides security guards, armored-car transport and cash services around the world. In the U.S., it operates security services and a cash business, GardaWorld Cash U.S., based in Boca Raton, Florida. The company has roughly 120,000 employees worldwide.

If the claim turns out to involve personal data, the people most likely to be affected include current and former security officers, armored-car crews, job applicants and business customers. GardaWorld has not said who, if anyone, is affected.

The Kinds of Records Security Employers Keep

GardaWorld has not said what information, if any, is involved. In general, security and armored-transport employers collect a lot of sensitive worker data to hire and license staff. That often includes:

• Names, addresses and dates of birth
• Social Security numbers and tax forms
• Driver’s license and other government ID numbers
• Background check and guard licensing records
• Payroll and direct deposit details

This list describes what such employers typically hold. It is not a list of data Qilin took or GardaWorld lost.

This Is Not GardaWorld’s First Reported Incident

GardaWorld Cash U.S. reported an earlier hacking incident to the Maine Attorney General. That incident ran from October 30 to November 16, 2023, and involved names with driver’s license or state ID numbers. The company sent notices in March 2024.

Bloomberg Law reported that the 2023 incident involved current and former Garda Cash employees and job applicants. The 2023 incident is separate from the October 2026 claim.

Steps to Take Now

No one needs to wait for a letter to protect themselves. People connected to GardaWorld can:

• Place a free credit freeze with Equifax, Experian and TransUnion
• Review bank, payroll and card statements for activity they do not recognize
• Be careful with emails, texts or calls that mention GardaWorld or a breach
• Keep any notice letter that arrives later

Do You Have Legal Options?

Employers that collect workers’ Social Security numbers, ID numbers and background records have a legal duty to protect that information. If GardaWorld confirms that personal data was involved, affected individuals may have legal rights and remedies.

Emery | Reddy is investigating the claimed GardaWorld attack. Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

FAQ

Has GardaWorld confirmed a data breach?

No. As of October 20, 2026, GardaWorld has not confirmed a data breach or made a public statement. The Qilin ransomware group claimed the attack on its leak site on October 19, 2026.

Was my information stolen?

That is not known. GardaWorld has not said whether any personal information was involved. If it confirms a breach, it may be required to send notice letters to people who are affected.

How many people are affected by the GardaWorld incident?

GardaWorld has not disclosed any number, and it has not confirmed that anyone is affected.

Who is Qilin?

Qilin, also called Agenda, is a ransomware group. It lets other hackers use its tools in exchange for a cut of any ransom. It often lists victims on a leak site to pressure them to pay.

Is this the same as the 2023 GardaWorld Cash breach?

No. GardaWorld Cash U.S. reported a separate hacking incident from late 2023 to the Maine Attorney General. The Qilin claim was posted in October 2026.

What should I do if I worked for, applied to, or was a customer of GardaWorld?

• Freeze your credit with all three credit bureaus
• Watch your bank, payroll and card accounts
• Save any letter or email you get from GardaWorld about this

How do I avoid scams that mention the incident?

Criminals often send fake messages that name a company in the news. Do not click links or open files in them. Contact GardaWorld using a phone number or website you already trust.

Do I have a legal claim?

Companies that collect your personal information have a duty to protect it and to tell you promptly if it is exposed. If you worked for, applied to, or were a customer of GardaWorld, you may have rights if a breach is confirmed. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.