OnTrac Notifies Customers of Data Breach After Network Hack

American package delivery service OnTrac is sending out notifications that hackers breached its corporate network and may have accessed customers' personal data.

According to the company, the incident was discovered on March 23. An internal investigation found that the attacker had access to certain files between March 20 and March 22. Exactly what information was compromised remains unclear: beyond names, the company redacted the list of affected data in the sample notification submitted to regulators.

OnTrac is a privately held American company specializing in last-mile delivery for e-commerce. It was formed in 2021 through the merger of OnTrac Logistics and LaserShip. The network comprises 102 facilities across 35 states, reaches roughly 70% of the U.S. population, and works with more than 7,000 independent delivery contractors.

A Hint of Ransom

In response to the incident, OnTrac brought in a third-party specialist to determine the scope of the breach and took steps to “ensure that the data in question had been re-secured and had not been disseminated.” The wording that the data “had not been disseminated” indirectly points to a possible arrangement with the attackers — typically, this refers to a ransom payment guaranteeing that customers' information will not be published.

“We are not aware of any instances of fraud or of the publication of stolen information as a result of this incident, and we have no reason to believe that any such misuse of the data will occur,” the notification states.

To help those affected mitigate the risks, OnTrac is offering a free one-year subscription to a credit monitoring and identity protection service from CyberScout — enrollment must be completed within 90 days. Customers are also advised to review their credit reports and account statements and, if necessary, to place a fraud alert or a credit freeze.

BleepingComputer reached out to OnTrac for details about the attack, the number of people affected, and whether a ransom was paid, but had not received a response as of publication. No extortion or ransomware group has yet claimed responsibility for the attack.

Source: Bleeping Computer