What Happened in the Quatrro Data Breach?
Quatrro Business Support Services Inc., a tech-enabled outsourcing firm headquartered in Marietta, Georgia, has disclosed a data breach that exposed sensitive personal information belonging to its clients’ customers or employees. The Quatrro data breach involved unauthorized access to company files that contained highly sensitive personal data. According to notification letters sent to affected individuals, the company first identified and began responding to a security incident on Dec. 7, 2025.
Quatrro’s investigation traced the unauthorized activity back further than the discovery date. As a result, the company determined that an unauthorized party had accessed certain files within its systems during a nine-day window, from Nov. 11 through Nov. 19, 2025. This means the intrusion itself occurred roughly three weeks before Quatrro detected it.
Because the files involved were extensive, Quatrro needed additional time to review their contents. After identifying the unauthorized access, the company conducted a thorough review of the affected files. On Feb. 25, 2026, that review confirmed the files contained personal information belonging to affected individuals. Only after this confirmation did Quatrro begin the formal notification process.
The forensic investigation and document review took several months to complete. This is a common pattern in breaches involving large volumes of unstructured data, since companies often must manually review files to determine exactly whose information was exposed. Quatrro reported the incident to attorneys general in Maine and New Hampshire on March 23, 2026, the same day it began notifying individuals.
Who was affected?
The Quatrro data breach affected individuals across multiple states. Regulatory filings identify two Maine residents, 11 Massachusetts residents and five New Hampshire residents as impacted. However, these state-specific numbers likely represent only a portion of the total affected population, since Quatrro provides outsourcing services to numerous client organizations across the country.
Because Quatrro is a business support and outsourcing provider, the individuals affected may include customers, employees or other parties connected to its corporate clients rather than direct Quatrro customers. The exact nationwide total has not been publicly disclosed. Additionally, the source does not specify whether minors were among those affected, so anyone who received a notification letter should assume their own information was directly involved.
What Information Was Potentially Exposed?
The unauthorized access exposed a wide range of personal and financial data. Not every affected person had the same categories of information compromised. Some individuals had only their name and Social Security number exposed, while others had additional sensitive details compromised as well.
- Full names
- Social Security numbers
- Driver’s license numbers
- Passport numbers
- Payment card numbers
- Financial account numbers
- Health insurance policy numbers
Given the presence of Social Security numbers alongside driver’s license and passport numbers, affected individuals face a heightened risk of identity theft. For example, criminals could use this combination of data to open new credit accounts, file fraudulent tax returns or apply for loans in someone else’s name. Because government-issued identification numbers were involved, the risk extends well beyond typical financial fraud.
In addition, the exposure of payment card numbers and financial account numbers creates a direct risk of unauthorized transactions. Meanwhile, the inclusion of health insurance policy numbers raises the possibility of medical identity theft, where someone else uses a victim’s insurance information to obtain treatment or equipment. As a result, affected individuals should watch not just their bank accounts but also their medical and insurance records for suspicious activity.
What is the company doing?
Once Quatrro confirmed that personal information had been compromised, it moved to notify affected individuals promptly. On March 23, 2026, the company began mailing written notification letters via United States Postal Service First-Class mail. These letters explain what data was involved for each individual and outline the protective resources available to them.
To help mitigate potential harm, Quatrro is offering all notified individuals a complimentary membership to credit monitoring and identity protection services through Kroll. This includes triple bureau credit monitoring, which alerts enrollees to changes on their credit file at any of the three national credit bureaus. The offering also includes unlimited fraud consultation with a Kroll specialist and identity theft restoration services, so victims of identity theft can get direct help resolving related issues.
Affected individuals can activate their monitoring by visiting Kroll’s enrollment website and entering the membership number found in their notification letter. Each letter includes a specific enrollment deadline, so recipients should act quickly. Quatrro has also set up a dedicated toll-free call center at 844-443-1281, available Monday through Friday from 9:00 a.m. to 6:30 p.m. EST, to answer questions from those affected.
What Should Affected Individuals Do?
Place a Fraud Alert or Credit Freeze
Because Social Security numbers, driver’s license numbers and financial account numbers were exposed, affected individuals should strongly consider placing a credit freeze with all three major credit bureaus. Contacting Equifax, Experian and TransUnion directly makes it much harder for anyone to open new accounts using stolen information.
Alternatively, a fraud alert offers a lighter-touch option. Placing an alert with just one bureau triggers notification to the other two automatically. This requires creditors to take extra steps to verify identity before approving new credit in your name, which can slow down fraudulent applications.
Monitor Financial Accounts and Credit Reports
Since payment card numbers and financial account numbers were part of this breach, affected individuals should review bank and credit card statements closely in the coming months. Look for any charges or withdrawals that seem unfamiliar, even small ones, since criminals sometimes test stolen card numbers with tiny transactions first.
In addition, request free credit reports at AnnualCreditReport.com and review them carefully for unfamiliar accounts. Doing this regularly, rather than just once, increases the chances of catching fraudulent activity early. If anything looks suspicious, dispute it with the relevant credit bureau right away.
Watch for Medical and Insurance Fraud
Because health insurance policy numbers were exposed, affected individuals should also monitor their insurance statements and medical records. Review any Explanation of Benefits notices for services you don’t recognize. This can be an early sign that someone else is using your insurance information.
If you notice unfamiliar claims or medical bills, contact your insurance provider immediately. Correcting fraudulent medical records can be a lengthy process, so catching the problem early makes resolution much easier.
Enroll in the Complimentary Kroll Identity Protection Services
Quatrro is offering free credit monitoring and identity restoration services through Kroll to all notified individuals. This service includes triple bureau credit monitoring and unlimited fraud consultation, which can help detect and address suspicious activity quickly.
To enroll, visit Kroll’s enrollment website and enter the membership number listed in your notification letter. Because each letter includes a specific deadline, it’s important to sign up as soon as possible rather than setting the letter aside.
Stay Alert for Phishing and Scams
Scammers frequently exploit real data breaches by sending fake emails or calls that reference the incident by name. Be cautious of any message claiming to be from Quatrro Business Support Services that asks you to click a link or provide additional personal details.
Instead, verify any communication by calling Quatrro’s official number directly. If you ever suspect identity theft has occurred, report it to the Federal Trade Commission at IdentityTheft.gov or by calling 1-877-438-4338, and consider filing a report with local law enforcement as well.
More Information
Official Notice from Quatrrobss
Official Data Breach Notification Letter (PDF)