Safetyfirst Systems data breach: driver compliance and motor vehicle records firm, January 2026

Why did I get a letter from Safetyfirst Systems?

Because a business you work for, or applied to, used Safetyfirst to check driving records or employee compliance. The letter says SFS provides those services to businesses, and each letter names the business in a field left blank in the filed sample. Many recipients will not have dealt with Safetyfirst directly. The guide to letters from companies you never dealt with explains how a service provider ends up holding your data. The guide to vendor breach notices compares how other vendors describe their role.

What happened at Safetyfirst Systems?

A log review on January 19, 2026 turned up suspicious activity in part of Safetyfirst's environment. The company says it secured and remediated the compromise, brought in outside experts and notified law enforcement. A forensic investigation found that the intruder had been in from January 16. The letter does not say how the intruder got in, whether data was copied out, or whether there was a ransom demand. It says there have been no alerts of suspicious activity since the response began.

California's record gives January 16 and January 19, 2026 as the breach dates. The letters followed six months after discovery.

Date	What happened	Source
January 16, 2026	Unauthorized access begins	Notice letter, California AG record, Indiana record
January 19, 2026	Log review finds suspicious activity; access ends	Notice letter, California AG record
July 23, 2026	Letter date; notice sent, per Indiana; published by Texas; reported to Washington	Notice letter, state records
October 21, 2026	Ninety days after the letter date: last day to enrol, and the end of the call line	Notice letter

What information was involved in the Safetyfirst breach?

The filed letter leaves the list as a blank before "and name". The state records fill it in:

• Washington lists name, Social Security number, driver's licence or Washington ID card number, and full date of birth.
• Texas lists name, Social Security number and driver's licence number.

The company says it knows of no fraud or identity theft from the incident.

How many people were affected?

Indiana gives the only total: 141,230 people. Three states count their own residents:

Record	People counted
Indiana attorney general, total	141,230
Texas residents	4,504
Indiana residents	1,837
Washington residents	1,157

Texas published its report on July 23, 2026, with notice by U.S. mail and on a website. The ranking of 2026 breaches by people affected shows where the Indiana total falls. The ranking of breaches affecting Texans compares the Texas count.

What is Safetyfirst offering?

TransUnion single-bureau credit monitoring, credit report and credit score, plus fraud assistance, through Cyberscout, a TransUnion company. The length is left blank in the filed sample. Enrolment is at bfs.cyberscout.com/activate with the code in the letter, within 90 days of the letter's date. For letters dated July 23, 2026, that was October 21, 2026, so the window has closed. The letter also suggests an Identity Protection PIN from the IRS, as well as fraud alerts and credit freezes. The guide to credit-monitoring offers compares this offer with others.

Was my information in the Safetyfirst Systems data breach?

A letter from Safetyfirst Systems, LLC dated July 23, 2026, sent "c/o Cyberscout" from Suwanee, Georgia, means your information may have been in the affected part of its environment. The letter names the business that used Safetyfirst for you. The call line, 1-833-289-5523, was open 7:00 a.m. to 7:00 p.m. Eastern Time on weekdays for 90 days from the letter's date. After that, the employer named in the letter is the place to ask. Safetyfirst's postal address is PO Box 101, 3299 US Highway 46, Parsippany, NJ 07054.

What the notice leaves open

• How the intruder got in, and whether files were copied out.
• Which businesses' drivers and employees were involved.
• What each person lost; the sample leaves the list blank.
• Why the letters took six months after the intrusion was found.