Centrestack Breach Exposes SSN and Other PII of Individuals

On Dec. 6, 2025, a cyberattack targeted the file-sharing platform provided by CentreStack, a product of Gladinet Inc. The incident involved unauthorized access to files stored on CentreStack’s platform by a third party exploiting a vulnerability in the system.

The breach was first disclosed by GiaCare, a user of CentreStack’s services, on Jan. 23, 2026. The company's disclosure details that the information exposed from GiaCare's files included name, driver’s license number and Social Security number.

The Clop ransomware group has a history of targeting secure file-transfer products and is suspected to be responsible for the data breach. According to BleepingComputer, the "Clop cybercrime gang is now scanning for and breaching CentreStack servers exposed online."

Official incident descriptions, however, have not identified the party responsible for the breach, and therefore have not named the Clop group directly.

The attack was part of a broader campaign in which Internet-exposed CentreStack file servers were breached, ransom notes were left and data-theft extortion activity was observed. The specific vulnerability exploited has not yet been publicly identified, so it is unclear whether it was a previously known flaw or a new zero-day issue.

CentreStack's response

At this time, CentreStack has not released any disclosures. Not much is known about the data breach aside from GiaCare's disclosure to the New Hampshire Attorney General.

This article will be updated to reflect updates as more information is released.

If you suspect you might be affected, it is important to enroll in the credit monitoring service and remain vigilant by reviewing account statements and credit reports for any suspicious activity.