Employer Solutions Staffing Group (ESSG) has confirmed a data breach. ESSG is a Minneapolis-based professional employer organization that runs outsourced payroll, benefits, tax filing and HR for client businesses. The company began mailing notification letters on November 12, 2026, ten months after it detected an intrusion on January 13. State attorney general filings so far add up to 19,735 affected people: 19,551 in Texas, 141 in Rhode Island and 43 in Vermont. Claim Depot describes the total as more than 20,000. One law firm, Strauss Borrelli, cites a far larger figure of 622,126 individuals from "regulatory filing data". No state filing reviewed for this brief supports that number. The exposed data includes Social Security numbers, government ID numbers, financial account and card details, and medical and health insurance records. Breach tracker Claim Depot reports that the Akira ransomware group claimed the attack and said it took 80GB of data. ESSG has not publicly named an attacker.
What Happened
According to Claim Depot's summary of the company's notice, ESSG noticed suspicious activity on its network on January 13, 2026. The company later found that files on its systems had been accessed or taken without authorization that same day. The exposure window appears to be one day, which suggests the attacker either took data quickly after getting in or was only spotted at the point they started taking it out.
ESSG then ran a review of the affected files to work out whose data was in them. That review finished on October 13, 2026, nine months after the intrusion. Regulator filings followed on November 12. The Vermont Attorney General's office posted the notice, which ClassAction.org, Dapeer Law, Cole & Van Note and Strauss Borrelli all cite. Claim Depot also reports a filing with California's attorney general. Strauss Borrelli refers to filings in Vermont and Texas. Letters to affected individuals went out by U.S. Mail starting November 12.
Accounts of the affected population differ widely:
- Claim Depot lists 19,551 Texas residents, 141 Rhode Island residents and 43 Vermont residents, which totals 19,735. Its "20K+" headline probably covers states whose counts have not been published yet.
- Cole & Van Note and Dapeer Law cite only the 43 Vermont residents.
- Databreachrights.com says the total has not been disclosed.
- Strauss Borrelli gives 622,126 individuals. That is more than 30 times the published state counts, and the firm does not name the filing it came from.
Until ESSG or a regulator publishes a national total, the best-supported figure is roughly 19,700 to 20,000 people, and it may grow. Readers should not treat the 622,126 figure as confirmed.
What Was Taken
Filings summarized by Claim Depot, ClassAction.org and Strauss Borrelli list these categories of exposed data:
- Names and Social Security numbers
- Driver's license and other government ID numbers
- Financial account numbers and credit or debit card information
- Medical records and health insurance information
Claim Depot reports that Akira posted on its Tor leak site on February 24, 2026, claiming 80GB of data. The group said the haul included passports, driver's licenses, Social Security numbers, financial records, HR files, client and partner information, and non-disclosure agreements. These are the attacker's own claims and have not been independently verified. ESSG's notice does not mention ransomware or confirm the data volume.
The mix of data is what makes this breach serious. A single record that combines an SSN, a government ID, bank details and health insurance information supports tax refund fraud, new-account fraud, payroll diversion and medical identity theft. Because ESSG is a professional employer organization, the people affected are mostly employees of its client companies. Many of them may never have heard of ESSG until the letter arrived.
Why It Matters
Professional employer organizations and payroll processors gather complete identity, banking and benefits records for workforces across many client companies. A single breach therefore exposes the employees of dozens or hundreds of employers at once, and the client companies have no direct control over how ESSG secures that data. Attackers know these firms hold valuable data. In a separate case reported by Dark Reading, an unidentified attacker copied about 69GB of database backups from the Philippine Overseas Employment Administration in 24 minutes, including worker contracts and financial records. Employment data is a deliberate target.
The timeline also deserves attention. Akira posted its claim in February, but affected individuals were not told until November. For nine months, anyone who downloaded the leaked data had a head start over the people it described. Client companies of a payroll or HR provider should not wait for formal notice once a ransomware group has named their provider.
The disclosure has already prompted at least four law firms (ClassAction.org affiliates, Dapeer Law, Cole & Van Note and Strauss Borrelli) to open class action investigations within a day of the filings. That level of legal attention is now normal for breaches involving SSNs and health data.
The Attack Technique
ESSG has not said how the attacker got in, and Strauss Borrelli notes that the filings give no technical cause. If Akira's claim is accurate, past reporting on the group points to likely routes. Akira typically gets in through VPN and remote-access appliances that lack multi-factor authentication, or through unpatched edge devices. It steals data before encrypting and then threatens to leak it to pressure victims into paying. None of this has been confirmed for ESSG.
Kaspersky's Securelist analysis of Storm-2603 shows how a ransomware intrusion can start without dropping files on disk. In that case, the attackers exploited the ToolShell flaws in on-premises SharePoint (CVE-2025-53770 and CVE-2025-53771). They ran their entire control layer inside the IIS worker process (w3wp.exe), then tried to disable endpoint security tools before deploying ransomware. There is no evidence linking Storm-2603 or SharePoint to the ESSG incident. The analysis is relevant because it shows how a short, one-day intrusion that ends in data theft can get past controls that only scan files.
What Organizations Should Do
- Review your PEO and payroll providers. Ask them for MFA coverage on all remote access, patch timelines for edge devices, and how long they keep data. Make breach notification to clients within a fixed number of days a contract requirement, rather than relying on state notification deadlines.
- Take ransomware leak-site claims about your providers seriously. Monitor leak sites and threat intelligence feeds for your vendors' names. When one is listed, start your own employee-protection measures right away instead of waiting for formal notice.
- Require phishing-resistant MFA on VPNs and remote access. Check firewall and VPN appliances for unpatched vulnerabilities and accounts protected only by a password. This is a well-documented way in for Akira.
- Watch for large outbound transfers. In both this case and the Philippine government breach, data was taken within hours or minutes. Alert on unusual volumes leaving file servers, especially to cloud storage or virtual private servers.
- Look for in-memory attacks on internet-facing apps. Watch for unusual child processes and .NET assemblies loaded into w3wp.exe, and make sure on-premises SharePoint is patched against ToolShell.
- Protect affected employees. If ESSG serves your company, encourage staff to place credit freezes, file IRS Identity Protection PIN requests, sign up for the credit monitoring ESSG offers, and watch for payroll or direct-deposit change scams that use the stolen HR data.
Sources: Employer Solutions Staffing Group Data Breach Affects 20K+ | How to detect fileless attacks exploiting ToolShell: analyzing the... | Philippine Migrant Worker Data Likely Leaked in 69GB Breach | Employer Solutions Staffing Group Data Breach Exposes SSNs | Employer Solutions Staffing Group Data Breach Notice (2026) | ESSG Data Breach Investigation - Cole & Van Note - California Data... | Employer Solutions Staffing Group Data Breach Investigation | Employer Solutions Staffing Group Data Breach Alert