Corporation Service Co. Data Breach Exposed Sensitive Government ID Numbers

Corporation Service Co., commonly known as CSC, disclosed a data breach that involved unauthorized access to a database hosted by a third party. So far, 2,481 Texas residents, 500 Massachusetts residents, 61 New Hampshire residents and 23 Vermont residents were impacted.

CSC detected suspicious activity on its network, which led to the discovery of the breach. An investigation into the incident determined that an unauthorized actor had gained access to a third-party hosted database between Aug. 10, 2025, and Aug. 25, 2025, and copied and removed certain files from the database.

On Oct. 21, 2025, the ransomware group CL0P posted a claim on the Tor network stating it had obtained data belonging to CSC.

After the initial investigation, CSC engaged a separate third party to conduct a detailed review of the compromised files. The goal was to identify what types of information the files contained and which individuals were affected.

The review was not completed until July 15, 2026, nearly a year after the breach occurred. CSC then performed additional work to verify the affected information and locate mailing addresses so it could notify those involved.

The types of personal information exposed in the breach included names, Social Security numbers, dates of birth, driver's license numbers, state identification card numbers, financial account information, credit or debit card numbers, Employer Identification Numbers and government-issued identification numbers such as passport numbers.

The company additionally reported the breach to the California Attorney General. CSC began notifying affected consumers on Aug. 13, 2026, approximately one year after the breach took place.

CSC's response

CSC is offering affected individuals 12 months of credit monitoring, credit report and credit score services at no cost. These services are being provided through Cyberscout, a TransUnion company that specializes in fraud assistance and remediation.

Affected individuals can enroll by visiting the Cyberscout activation page and entering the unique code included in their notification letter. Enrollment must be completed within 90 days of the letter's date.

Individuals with questions about the breach can call CSC's dedicated assistance line at 1-866-898-4668. The line is available Monday through Friday from 8 a.m. to 8 p.m. ET, excluding major U.S. holidays.

Affected individuals can also write to CSC at 251 Little Falls Drive, Wilmington, DE 19808.