OnTrac Discloses Data Breach After Network Intrusion

OnTrac, a private American parcel-delivery company, is notifying customers that hackers breached its corporate network and may have accessed personal information. The company detected the intrusion on March 23, and a subsequent internal investigation found that the attacker had accessed certain files between March 20 and March 22.

OnTrac has not disclosed the full scope of the data involved. Names were confirmed as exposed, but the company redacted other data elements in the notification sample it filed with regulators, leaving the exact categories of compromised information unclear.

Formed in 2021 from the merger of OnTrac Logistics and LaserShip, the company specializes in last-mile e-commerce deliveries. It operates 102 locations across 35 states, covers roughly 70% of the U.S. population, and works with more than 7,000 independent delivery contractors, making any customer data exposure potentially far-reaching.

Signs of a Possible Ransom Payment

In its notification, OnTrac states it took steps to “ensure the data described above was re-secured and not distributed,” language that suggests the company may have reached an agreement, likely involving a ransom payment, with the attackers to prevent the leak or sale of stolen customer data.

The company says it has no evidence of fraud or public disclosure of the stolen information and does not currently expect any misuse to occur. It also brought in a third-party incident response specialist to help scope the breach.

Remediation Offered

To help affected customers, OnTrac is providing 12 months of free credit monitoring and identity protection through CyberScout, with a 90-day enrollment window. The company is also advising recipients to review credit reports and account statements, and to consider placing a fraud alert or credit freeze if they believe their risk is significant.

As of publication, no ransomware or data extortion group has claimed responsibility for the attack, and OnTrac has not disclosed the number of customers impacted or confirmed whether a ransom was paid.