The Job Shop, a nationwide staffing and employment agency, experienced a major data breach. On Aug. 14, 2025, the company was notified by its third-party IT services vendor that a cyberattack had occurred. An investigation revealed that a cybercriminal accessed a server belonging to The Job Shop and may have obtained files with personally identifiable information (PII).
A ransomware group known as PEAR claimed responsibility for the breach. PEAR stated they had leaked 135 GB of data, including financial records, PII and PHI, partner and vendor data, client information and full email correspondence. The hack was posted on a dark web Tor network site, indicating a ransomware attack with a public data leak.
A review confirmed that the hacked server contained completed Forms W-2 for 2018, 2019 and 2020. The Job Shop and their IT vendor was unable to determine if some or all W-2 forms stored on the server were compromised during the cybersecurity incident.
Exposed information included names, addresses and Social Security numbers. The total number of impacted individuals has not been released, but is believed to be in the thousands.
The Job Shop has begun notifying affected individuals by mail. The data breach was also disclosed to the Massachusetts Attorney General's office on Sept. 29, 2025.
In addition to required state and federal disclosures, The Job Shop is offering impacted individuals 24 months of free credit monitoring and identity theft protection services through Equifax Credit Watch Gold. This includes credit monitoring with email notifications, daily access to Equifax credit reports, WebScan notifications for personal information found on fraudulent sites, automatic fraud alerts, identity restoration services and up to $1 million in identity theft insurance coverage.
If you receive a notice from The Job Shop about this breach, you may want to:
More information about the company is available on The Job Shop’s website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.