Yellow Corporation data breach: files taken in March 2025, notice by press release, 258,498 people

What happened at Yellow Corporation?

Yellow says it identified suspicious activity on its computer network on or about March 27, 2025. It investigated with outside cybersecurity specialists, took its systems offline briefly and restored them from backups. The review found that files on the network had been accessed and taken without permission that same day. The notice does not use the word ransomware.

Date	What happened	Source
March 22, 2025	Start of the breach window	Oregon list
March 27, 2025	Suspicious activity found; files taken	Yellow notice; Oregon list; Indiana report
June 26, 2026	Media release and website notice; Indiana notice (6,191 residents)	Yellow notice; Indiana report
July 8, 2026	Reported to Oregon (258,498)	Oregon list

Notice came 456 days after the files were taken. The notice-delay guide shows how that compares.

Why did Yellow give notice by press release?

The notice says the data was historical, so Yellow could not identify or confirm contact details for the people in it. Yellow says it is notifying people through the media release and its website, and telling regulators where necessary. Many of the 258,498 may therefore never get a letter. Anyone whose records Yellow held could be in the files.

What information was exposed?

The notice lists name, Social Security number, date of birth, driver's license or state ID number, passport number, other government ID numbers, financial account and payment card numbers, medical information and health insurance information. Not every item applies to every person.

Whose data was in the Yellow breach?

Mostly former Yellow employees. The notice posted on Yellow's website says the review was completed and that the substantial majority of the information identified relates to former Yellow employees. The notice is issued by Yellow Corporation and its affiliated debtors and debtors-in-possession in their jointly administered chapter 11 cases (Case No. 23-11069, Bankruptcy Court for the District of Delaware). The notice gives the historical nature of the data as the reason Yellow could not identify or verify contact details.

Question	What Yellow's website notice says
Who is affected?	Mostly former employees
When were files taken?	On March 27, 2025
How was it handled?	Systems briefly taken offline and restored from backups
Why no letters?	Historical data; contact details could not be identified or verified
Where to write	Yellow Corporation, 11500 Outlook Street, Suite 400, Overland Park KS 66211

Former Yellow employees who never got a letter can call the assistance line in the notice. The guide to letters from companies you never dealt with covers the reverse case, a letter from a company you do not know.

What should I do?

Yellow offers no credit monitoring; it points to free resources and guidance instead. Its assistance line is 833-289-4340, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern, excluding U.S. holidays. The notice also points to myyellow.com and the bankruptcy case site run by Epiq. With Social Security numbers among the data, a credit freeze at Equifax, Experian and TransUnion is the main free step; the guide to credit monitoring offers explains why.

How many people were affected?

258,498, per Oregon's list. Indiana records 6,191 Indiana residents with no total. Yellow's notice gives no count. The largest data breaches of 2026 shows where it sits.

Texas's attorney general lists a report from Yellow Corporation and its affiliated debtors in their chapter 11 cases, posted on June 30, 2026, with 13,183 Texans affected. The Texas record lists names, Social Security numbers, driver's license numbers, other government ID numbers, financial account or card numbers, medical information, health insurance information and dates of birth among the information involved. The Texas ranking lists 2026's largest reports. The figure counts Texans only.

How many Washingtonians were affected by the Yellow breach?

Washington's attorney general lists a notice from Yellow Corporation and its affiliated debtors, reported on June 26, 2026, with a breach date of March 27, 2025. It gives the number of Washingtonians affected as unknown. The record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, passport numbers, health insurance policy or ID numbers and medical information as the information compromised.

What the record leaves open

• How many of the 258,498 are former employees, and who the rest are.
• How the intruder got in.
• Why the review took until June 2026, 15 months after the files were taken.