Major US delivery company hit in data breach with full names, SSNs and medical info of thousands exposed online

Thousands of people have had their sensitive personal information exposed in a data breach at U.S. delivery company OnTrac that occurred over two days in April 2025. According to reporting from Cybernews, more than 40,000 individuals have been impacted by a data breach that exposed personal details including names, date of birth, Social Security numbers, driver’s license or state IDs, and medical and/or health insurance information.

OnTrac has sent out data breach notification letters informing affected individuals that their personal data may have been compromised. According to a sample letter obtained by the Office of the Maine Attorney General, the attackers reportedly had access to the company’s network between April 13th and April 15th 2025. The data that they accessed can now be used to commit a variety of malicious activities including medical identity theft where threat actors can submit fraudulent insurance claims or acquire prescription drugs for resale, or other forms of identity theft like setting up fraudulent bank accounts, false tax returns or taking over an individual’s benefits.