Cornerstone Staffing Solutions data breach: notice ten months after the intrusion

What happened at Cornerstone Staffing?

Cornerstone says it started an internal investigation and, through its lawyers, hired a cybersecurity firm to contain the threat. The investigation could not identify the root cause. A vendor then reviewed the data in the affected areas to find whose information was there, a task it finished on August 7, 2026.

Date	What the letter and the regulators' records say
November 6, 2025	Possible unauthorized access begins
November 17, 2025	Cornerstone detects the activity
November 21, 2025	Possible access ends
August 7, 2026	Review of the affected data finished
September 11, 2026	Letter date; recorded by California, Indiana and Washington
September 12, 2026	Logged in Massachusetts
September 15, 2026	Posted on the Texas attorney general's list

The letters went out 298 days after detection and 35 days after the data review finished. The guide to notice delays sets that gap beside the rest of the log.

Was my information taken?

Not necessarily. Cornerstone could not tell which files, if any, were taken, so it wrote to everyone whose information was in the affected systems. It says getting a letter does not mean your information was accessed or taken. It also says no one has reported identity theft to it.

What information was involved?

The letter lists the reader's own items after the name. The state records give the full range:

Regulator	Information it records
Washington attorney general	Name; Social Security number; driver's license or Washington ID card number; financial and banking information; full date of birth; military ID number; passport number; health insurance policy or ID number; medical information; username and password or security question answers; other
Texas attorney general	Name; address; Social Security number; driver's license number; government-issued ID number; financial information; medical information; health insurance information; other; date of birth
Massachusetts consumer affairs office	Social Security numbers, medical records, financial accounts and driver's licenses marked as breached; payment cards not

Washington's list includes usernames with passwords or security answers. Anyone who used the same password elsewhere should change it.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	357,444
Texas attorney general	Texans	4,425
Washington attorney general	Washingtonians	681
Indiana attorney general	Indiana residents	257
Massachusetts consumer affairs office	Massachusetts residents	243

What is Cornerstone offering?

Complimentary credit monitoring and identity protection through HaystackID, for the number of months printed on each letter. Enrollment is at www.equifax.com/activate within 90 days of the letter date.

Item	Detail from the letter
Provider	HaystackID
Enrollment	www.equifax.com/activate, within 90 days of September 11, 2026
Phone	866-210-2106, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern, excluding U.S. national holidays

What the documents leave open

• How the intruder got in. The investigation could not find the root cause.
• Which files, if any, were taken.
• Whose records the systems held: workers, applicants, clients' employees or others.