Cardinal Services data breach: two intrusions in 2025 and 142,323 people notified

Was Cardinal Services breached twice?

By its own account, there was a second round of unauthorized access after the first. Cardinal says it began investigating the June access with outside cybersecurity professionals, and during that investigation, on August 8, 2025, it became aware of further unauthorized access. It then worked with the same professionals to secure its internal environment. The notice does not say whether the two intrusions were the same attacker, how either began, or whether ransomware was involved.

What happened, and when?

Date	What happened	Source
June 25 to 26, 2025	First access to the systems; Indiana's breach date is June 25	Cardinal notice; Indiana record
On or around June 30, 2025	Cardinal becomes aware of the access	Cardinal notice
On or around August 8, 2025	Further unauthorized access, found the same day	Cardinal notice
May 12, 2026	Review finds personal information in the systems	Cardinal notice
May 20, 2026	Letters begin; Indiana's notice date	Cardinal notice; Indiana record
May 22, 2026	Texas publishes the report (284 Texans)	Texas record

From the first detection to the letters took 324 days. The notice-delay guide puts that in context.

What information was involved in the Cardinal Services breach?

The items vary by person but, taken together, include name, date of birth, Social Security number, driver's license or state ID number, financial account information, medical information, health insurance information, digital signature and biometric information. Texas's record for its 284 residents lists five of these: name, Social Security number, driver's license number, financial information and medical information. The same record gives Coos Bay, Oregon as Cardinal's city.

Cardinal says it has no evidence that anyone's information has been or will be misused.

How many people were affected by the Cardinal Services breach?

142,323 people, the total Cardinal reported to Indiana. Of the roughly 1,300 notices in Indiana's 2026 report, 57 give a larger total.

Record	What it counts	Number
Indiana attorney general	People affected in total	142,323
Texas attorney general	Texans	284
Indiana attorney general	Indiana residents	122

Texas also lists a Cardinal Services LLC in West New Iberia, Louisiana. No document fetched for this entry ties that company to the Oregon notice, so its record is left out here.

Washington's attorney general lists a notice from Cardinal Services, Inc. and Cardinal Employer Organization reported on May 20, 2026, with 2,066 Washingtonians affected. Its record names names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, passport numbers and medical information as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What is Cardinal offering people who got a letter?

Complimentary credit monitoring for people whose Social Security numbers were in the files, and guidance on protecting their information for everyone notified. Cardinal's response line, 844-558-4632, is open Monday to Friday, 8:00 a.m. to 8:00 p.m. Central time, and can say whether a caller is affected and eligible for monitoring. The guide to credit monitoring offers compares this kind of offer with others.

Was my information in the Cardinal Services data breach?

If you got a letter from Cardinal Services, Cardinal Employer Organization or Preferred Employer Solutions from May 2026 on, your information was in the affected systems. Cardinal says it wrote to people for whom it had contact information. If you are not sure, the response line above is the number Cardinal set up to tell people whether they were affected.

What the documents leave open

• How the intruders got in, each time.
• Whether the two intrusions were linked.
• How Cardinal came to hold medical and biometric information on these people.