CTS Journey Holdings discovered in July 2026 that hackers had been inside its network since December 2025. The company still has not said publicly what kind of information was stolen, beyond people’s names.
CTS Journey Holdings, LLC, a Delaware company doing business as Corporate Travel Service, has notified customers that an unauthorized actor gained access to its network environment between December 3 and December 11, 2025. The company says it discovered the intrusion on July 2, 2026, and filed notice with the California Attorney General on August 3, 2026.
CTS says an unauthorized actor accessed its network environment sometime between December 3 and December 11, 2025. The company hired outside cybersecurity professionals to investigate and says it completed an extensive forensic investigation and manual document review before determining, on July 2, 2026, that the compromised systems contained customer personal information.
CTS’s notice letter confirms that the exposed information includes each customer’s full name. The version of the letter reviewed for this post does not specify what other categories of information were involved. That section was blank or redacted in the sample copy available. Individual notice letters sent to customers should list the exact data types involved in each case.
Separately, CTS’s notice states that 15 Rhode Island residents were affected by this incident, a disclosure required under that state’s law. The company has not disclosed a nationwide total.
CTS says the unauthorized access happened between December 3 and December 11, 2025, but the company didn’t discover it until July 2, 2026 — nearly seven months later. CTS then filed notice with the California Attorney General on August 3, 2026, roughly eight months after the intrusion itself. CTS has not explained what caused the gap between the intrusion and its discovery.
CTS is offering affected customers complimentary Single Bureau Credit Monitoring, Credit Report, and Credit Score services through Cyberscout, a TransUnion company. The notice letter does not specify how many months of monitoring are included in the version reviewed for this post.
Companies that collect and store customer information, including travel service providers, have a legal duty to protect it. An eight-month gap between a network intrusion and formal notice raises questions about whether CTS met that duty. Customers who received a notice letter from CTS Journey Holdings may have legal rights and remedies worth discussing with an attorney.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.
Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.
How many people were affected by the CTS Journey Holdings data breach?
CTS has not disclosed a nationwide total. Its notice letter confirms 15 Rhode Island residents were affected; the number of people affected in other states is not yet known.
What information was exposed in the breach?
CTS confirms that customers’ full names were involved. The company has not publicly detailed what other information may have been exposed — check your individual notice letter for the specific data types listed for you.
Why did it take CTS so long to notify customers?
CTS says the intrusion happened between December 3 and December 11, 2025, but it didn’t discover the breach until July 2, 2026, and didn’t file notice with the California Attorney General until August 3, 2026, about eight months after the intrusion.
Is CTS offering credit monitoring?
Yes. CTS is offering complimentary Single Bureau Credit Monitoring, Credit Report, and Credit Score services through Cyberscout, a TransUnion company.
Should I sign up for the monitoring if I get a letter?
Yes. It’s free, and it can alert you if someone tries to open a new account in your name.
What else can I do to protect myself?
Consider these steps:
Has anyone sued CTS Journey Holdings over this breach?
Not as of this writing. No data-breach lawsuit against CTS Journey Holdings has been identified yet.
Do I have a legal claim?
Companies that collect personal information have a legal duty to keep it secure. If that duty was not met, affected individuals may be entitled to compensation. Emery | Reddy offers free, no-obligation case reviews. Call 206.207.8929 or visit www.emeryreddy.com to speak with a data breach attorney.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
