OnTrac Data Breach Exposes Customer Information After Network Hack

OnTrac has started notifying customers after hackers accessed its corporate network and may have obtained personal information.

The parcel delivery company detected the incident on 23 March. Its investigation found that the attacker accessed certain company files between 20 and 22 March.

OnTrac has not disclosed the full scope

OnTrac confirmed that the affected files contained customer names. However, the company redacted the remaining data categories from the notification it filed with authorities, so the full extent of the exposed information remains unclear.

The company hired an external cybersecurity specialist to investigate the incident and determine its scope. It also said it took steps to secure the affected data and prevent its distribution.

That wording may indicate that OnTrac reached an agreement with the attackers, potentially involving a ransom payment. However, the company has not confirmed whether it paid a ransom.

No reported fraud so far

OnTrac says it has not identified fraud, publication of stolen information or other misuse connected to the incident. The company also says it has no reason to expect misuse at this stage.

To support affected customers, OnTrac is offering 12 months of free credit monitoring and identity protection through CyberScout. Customers must enrol within 90 days.

The company also advises recipients to review their credit reports and account statements. Customers who believe they face a higher risk can consider placing a fraud alert or credit freeze on their credit files.

Delivery firm serves much of the US

OnTrac operates as a private US parcel delivery company focused on last-mile e-commerce deliveries. The company formed in 2021 through the merger of OnTrac Logistics and LaserShip.

It operates from 102 locations across 35 states, reaches around 70% of the US population and works with more than 7,000 independent delivery contractors.

No ransomware or data-extortion group has publicly claimed responsibility for the OnTrac data breach. The number of affected customers also remains unknown.