A ransomware group claims it stole employee Social Security numbers, passwords, payroll records, and driver license scans from The Buckner Company, an insurance brokerage. The company has not publicly confirmed this breach. If you worked there, monitor your credit reports and consider a credit freeze as a precaution right away.
| Company | The Buckner Company, Inc. |
|---|---|
| Industry | Insurance |
| Data Types Exposed | Social Security Numbers, Passwords and Login Credentials, Compensation and Payroll Records, Driver License Scans, Corporate Tax Returns, Business Email Archives, Insurance Database Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewA ransomware group has claimed it stole sensitive data from The Buckner Company, Inc., a commercial property and casualty insurance brokerage based in Salt Lake City, Utah. The group posted an alleged dataset online, saying it includes employee Social Security numbers, passwords, payroll files, and driver license scans. As of now, the company has not publicly confirmed this breach actually occurred.
What Happened in the The Buckner Company Data Breach?
According to claims posted by the ransomware group, attackers gained access to internal systems at The Buckner Company and copied a large volume of business and employee data. The group says the stolen files include email archives, payroll records, and insurance management databases. However, because this claim comes only from the attacker’s own leak-site posting, key details remain unverified.
The exact timeline of the alleged intrusion has not been publicly disclosed. The breach discovery date for this incident is not publicly disclosed either. As a result, it is unclear exactly when unauthorized access may have first occurred or how long attackers may have had access to company systems before the posting appeared.
Because The Buckner Company has not issued a public statement about this incident, there is no confirmed information yet about any internal investigation or forensic response. Readers should treat the details below as allegations from the threat actor group, not as confirmed facts from the company itself. This article will be updated in tone and substance only if the company issues an official confirmation or notification.
Who was affected?
Based on the attacker’s claims, the exposed data appears to primarily involve current and former employees of The Buckner Company and its related entities. The alleged dataset reportedly includes payroll and tax records spanning multiple years, suggesting a broad range of past and present staff could be affected. In addition, the claims reference business partners and insurance carriers whose information may appear in email archives and client files.
The number of affected individuals has not been publicly disclosed by the company. However, the attacker’s claims reference Social Security numbers for an estimated range of individuals, along with driver license scans tied to seven named people. Because this is an insurance brokerage, affected individuals could include employees across Utah, Colorado, and potentially other states where the company does business.
What Information Was Potentially Exposed?
The ransomware group’s posting describes a wide variety of sensitive business and personal data categories. If accurate, this would represent a significant exposure of both employee personal information and confidential company records. The alleged dataset reportedly includes the following categories of information.
- Plaintext passwords and credentials from employee browsers and spreadsheets
- Employee Social Security numbers from W-2 and 1099-NEC tax records
- Individual compensation records including salary, bonus, and benefits data
- Driver license scans for named individuals
- Corporate tax returns spanning multiple years and entities
- Business email archives (Outlook PST files)
- Insurance management database records
- Mergers and acquisitions due diligence and deal documents
If these claims are accurate, affected employees could face a heightened risk of identity theft. Social Security numbers combined with driver license scans give criminals nearly everything needed to open fraudulent credit accounts. In addition, stolen passwords could let attackers break into banking, insurance, or personal accounts directly, especially since the alleged files reportedly cover both work and personal logins.
Beyond individual identity theft, the inclusion of payroll, benefits, and compensation details raises the risk of targeted phishing attacks. Scammers often use real salary or HR data to make fraudulent emails look convincing. This means affected employees might receive messages that appear to come from payroll or benefits providers but are actually designed to steal further information or money.
What is the company doing?
Because The Buckner Company has not issued a public statement regarding this alleged incident, there is no confirmed information about any response, investigation, or notification process at this time. The company has not confirmed whether it is working with cybersecurity forensic experts or law enforcement. Likewise, there is no public confirmation of whether affected employees have been notified directly.
Readers should be cautious about assuming any specific protective measures, such as credit monitoring enrollment, have been offered until the company makes an official statement. If The Buckner Company later confirms the breach or files a formal notification with a state regulator, this article can be updated to reflect that. For now, individuals who believe they may be affected should take independent precautions described below rather than wait for a company response.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request a free copy of their credit report from each of the three major credit bureaus. Reviewing these reports regularly helps you catch unauthorized accounts or inquiries early. Because the alleged dataset reportedly includes Social Security numbers, this step is especially important.
You can access free weekly credit reports through AnnualCreditReport.com. In addition, consider setting a recurring reminder to check your reports every few months going forward. Early detection of suspicious activity often makes it easier to limit financial damage.
Consider a Credit Freeze or Fraud Alert
Because the claimed data includes Social Security numbers and driver license scans, a credit freeze is one of the strongest protections available. A freeze blocks new creditors from accessing your credit file, which makes it much harder for criminals to open accounts in your name. You can request a freeze directly with each credit bureau at no cost.
Alternatively, a fraud alert requires creditors to take extra verification steps before approving new credit in your name. This option is less restrictive than a freeze but still adds a layer of protection. Either step can help reduce your risk while this situation remains unconfirmed.
Watch for Phishing and Social Engineering Attempts
Given the alleged exposure of payroll and compensation data, affected individuals should be alert to emails or calls referencing specific salary or benefits details. Scammers often use real personal data to appear legitimate. As a result, always verify requests for money or sensitive information through a separate, trusted contact method.
Avoid clicking links or downloading attachments from unexpected emails, even if they appear to come from HR or a known vendor. Instead, contact the sender directly using a verified phone number or website. This simple habit can prevent many follow-on scams tied to leaked data.
Change and Strengthen Passwords
Because the claimed dataset reportedly includes plaintext passwords from employee browsers, affected individuals should change passwords immediately across all important accounts. This includes work accounts, banking, email, and any personal accounts that may share a password with a compromised one. Reusing passwords across multiple sites significantly increases risk after any credential leak.
Consider using a password manager to generate and store strong, unique passwords for each account. In addition, enable multi-factor authentication wherever it’s available, especially on banking and email accounts. This adds a critical barrier even if a password is later compromised.
Consult a Data Breach Attorney
If you believe your information was included in this alleged breach, it may be worth speaking with a data breach attorney for a free case evaluation. An attorney can help you understand your legal options, including whether you may be eligible to join a class action if the breach is later confirmed. This is particularly relevant given the sensitivity of the data categories claimed, including Social Security numbers and driver license scans.
Keep records of any suspicious activity you notice on your accounts going forward. This documentation could become important if a formal claims process is established later. Acting early helps preserve your options even while many details of this incident remain unconfirmed.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.