Employer Solutions Staffing Group data breach letter: files taken January 13, 2026, SSNs listed in Vermont

Date	Event
January 13, 2026	ESSG becomes aware of suspicious activity; files accessed or taken the same day
October 13, 2026	File review identifies whose information was in the files
November 12, 2026	Date on the letters; notice posted by the California attorney general and logged in Vermont

What happened at Employer Solutions Staffing Group?

ESSG says it became aware of suspicious activity in its network on January 13, 2026, secured its systems and began an investigation. The investigation found that files had been accessed or taken that same day. The company then reviewed the affected files to see what information they held and whose it was; that review ran until October 13. The letter does not say how the intruder got in or whether ransomware was involved.

What information was exposed?

The filed letter names the person's name and leaves the other data elements as a field filled in per letter. Vermont's record of the notice lists Social Security numbers, government ID numbers, financial account codes, credit and debit account information, and health records. The letter does not say which files they were. Your own letter lists what applies to you.

Did ESSG report the breach to the police?

Yes. ESSG says it notified law enforcement and will notify regulators as required. It also says it is reviewing its policies and procedures to make a similar event less likely.

What is ESSG offering, and by when must I enroll?

Credit monitoring through IDX. The sample letter offers 12 or 24 months, depending on the letter, and people must enroll themselves. The enrollment deadline is February 12, 2027. Enroll at response.idx.us/ESSG or call 1-877-201-3335, Monday through Friday, 9 am to 9 pm Eastern. Letters can go to ESSG at 7201 Metro Blvd, Suite 900, Minneapolis, MN 55439. Credit monitoring offers in breach letters compares this offer with others in the log.

Should I freeze my credit?

The letter describes both options. An initial fraud alert lasts one year, and identity theft victims can get a seven-year extended alert. A credit freeze stops a bureau from releasing your report without your authorization, and federal law makes placing or lifting one free.

Why did I get a letter from a staffing company?

The letter does not say whether the people it went to were ESSG's own staff, workers it placed or clients' employees. Why you got a breach letter from a company you never dealt with explains how a third party ends up holding your data. The sector table shows how long notices take in each sector.