A ransomware group called Chaos claims to have stolen data from Express Employment Professionals, a staffing firm, after the company allegedly did not respond to contact attempts. Job seekers, placed workers, and clients may be affected. The exposed data could include Social Security numbers and employment records. Affected individuals should monitor credit reports and consider a credit freeze immediately.
| Company | Express Employment Professionals |
|---|---|
| Industry | HR Technology |
| Data Types Exposed | Full Names, Contact Information, Social Security Numbers, Employment History, Financial or Payroll Information, Identification Documents |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Express Employment Professionals Data Breach?
Express Employment Professionals, a staffing and workforce services firm, is now facing a data breach claim. A ransomware group known as Chaos says it obtained files from the company’s systems. As a result, current and former job seekers, employees, and clients may be at risk.
The exact timeline of the intrusion has not been publicly disclosed. However, the threat actors state they attempted to contact company leadership before going public. According to the group, those outreach efforts were met with silence. This led the attackers to move forward with what they describe as a public release phase for the stolen data.
Because a specific discovery date has not been released, it remains unclear exactly when Express Employment Professionals first learned of the intrusion. The breach notification associated with this incident came in September 2026. Investigators and forensic teams typically need weeks to confirm what data was taken and how attackers got in. At this stage, the company has not released a full account of its internal investigation.
This pattern, in which a ransomware group claims a breach and threatens public release, is common among groups like Chaos. In many cases, this tactic is used to pressure a company into negotiating. Nonetheless, the underlying concern for affected individuals remains the same: their personal information may now be exposed.
Who was affected?
|
The population affected by this breach likely includes people who interacted with Express Employment Professionals in some capacity. This could include job applicants, placed employees, and business clients who used the firm’s staffing services. Because staffing companies handle sensitive onboarding paperwork, the scope of exposure could be broad.
At this time, the exact number of affected individuals has not been publicly disclosed. Given the nature of the company’s business across the United States, the impact could stretch across multiple states. In addition, because staffing agencies often work with a wide range of employers, both job seekers and corporate clients could be impacted.
It is also possible that former employees or applicants who applied years ago could be included. Staffing firms often retain applicant records for extended periods. Therefore, individuals who have not worked with the company recently should still consider themselves potentially at risk.
What Information Was Potentially Exposed?
While a full data inventory has not been released, breaches involving staffing and employment firms typically involve sensitive personal and employment-related records. Because Express Employment Professionals processes onboarding, payroll, and background information, several categories of data could be involved.
- Full names
- Contact information such as addresses, phone numbers, and email addresses
- Social Security numbers
- Employment history and job placement records
- Financial or payroll-related information
- Identification documents used during hiring
If Social Security numbers or identification documents were included, affected individuals could face a heightened risk of identity theft. Criminals can use this type of data to open new credit accounts, file fraudulent tax returns, or apply for loans in someone else’s name. This kind of fraud can take months to detect and even longer to resolve.
In addition, exposed employment and payroll records could be used for targeted phishing attempts. For example, a scammer might pose as a staffing coordinator or employer to trick victims into revealing more information. Because staffing relationships often involve trust and ongoing communication, these scams can be especially convincing.
What is the company doing?
Details about the company’s formal response have not been widely published. However, in incidents like this, organizations typically begin by securing their network and launching an internal investigation. This usually involves outside cybersecurity specialists who assess how the intrusion occurred.
Following containment, companies generally work to determine which individuals were affected and prepare required notifications. If Express Employment Professionals confirms that personal data was compromised, it will likely need to notify affected individuals directly. In many similar cases, businesses also offer credit monitoring or identity protection services to those impacted.
Because the threat actors claim leadership did not respond to their outreach, it is unclear whether formal negotiations ever took place. As more information becomes available, affected individuals should watch for official communication directly from the company.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone who may have worked with or applied through Express Employment Professionals should check their credit reports regularly. This helps catch unauthorized accounts or unfamiliar inquiries early. You can request free reports from each of the three major credit bureaus.
Because identity thieves often wait before using stolen data, ongoing monitoring is important even months after a breach. If you notice anything suspicious, report it immediately. Early detection can significantly reduce the damage caused by fraud.
Consider a Fraud Alert or Credit Freeze
If Social Security numbers were exposed, placing a fraud alert or credit freeze is a strong protective step. A fraud alert requires lenders to verify your identity before opening new credit. A credit freeze goes further by blocking access to your credit file entirely.
Both options are free and can be requested directly through the credit bureaus. While a freeze offers stronger protection, it does require you to lift it temporarily when applying for new credit. This small inconvenience is often worth the added security.
Watch for Phishing and Impersonation Attempts
Because employment records may have been exposed, affected individuals should be cautious of unexpected emails or calls claiming to be from Express Employment Professionals. Scammers often use real company names to appear legitimate. As a result, verifying the source before clicking links or sharing information is essential.
If you receive a message asking for personal details, contact the company directly using a verified phone number or website. Avoid replying to the message itself. This simple step can prevent falling victim to a secondary scam tied to the breach.
Keep Records of Any Suspicious Activity
If you notice unusual account activity or receive suspicious communications, document everything. Save emails, screenshots, and any related correspondence. This documentation can be useful if you need to file a police report or dispute fraudulent charges.
In addition, keeping detailed records may help support a potential legal claim if the breach is later confirmed to have affected you directly. Consulting a data breach attorney can help clarify your options. Many offer free consultations to evaluate whether you may be entitled to compensation.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.