Background Check, Drug Testing Firm Hack Affects 3.3 Million

DISA Global Solutions, a third-party administrator of worker background checks and drug and alcohol testing for employers across multiple industries, reported that a data theft incident a year ago has affected more than 3.3 million people.

See Also: Top 10 Technical Predictions for 2025

In a breach report filed to Maine’s attorney general Monday, DISA said it discovered on April 22, 2024, that a cyber incident that affected a portion of its network.

An investigation into the incident found that an unauthorized third party accessed DISA’s environment between Feb. 9, 2024, and April 22, 2024, and acquired some information.

“Although our forensics investigation could not definitively conclude the specific data procured, DISA conducted a detailed and time-intensive review of the affected files to identify the personal information contained” in the files.

DISA in a breach notice posted on its website said affected information includes individuals’ name, Social Security number, driver’s license number, other government ID numbers, financial account information, “and other data elements.”

Not every person had the same data elements compromised, DISA said. The affected files “came into our possession due to the employment screening services we provide employers and prospective employers,” DISA said. “Presently, we are unaware of any attempted or actual misuse of any information involved in this incident.”

Databreaches.net reported that an earlier version of DISA’s breach notice, which has apparently been removed from the web, referenced the company taking measures “to dissuade the threat actor from publicly releasing any acquired data and to provide confirmation of the deletion of the data.”

An attorney representing DISA in its breach report to Maine’s attorney general did not immediately respond to Information Security Media Group’s request for additional details about the incident, including whether DISA paid a ransom in exchange of a promise by cybercriminals to destroy the company’s stolen data.

DISA’s website says the company has more than 55,000 clients across more than a dozen industries, including 30% of Fortune 500 firms. Industries served by DISA include healthcare, financial and professional services, retail hospitality and transportation.

Sensitive Data

The nature of DISA’s business and the type of data it handles makes the incident especially worrisome, some experts said.

“This breach is concerning because the type of data obtained has strategic value to adversaries, more than its value in perpetrating financial fraud,” said Mike Hamilton, field CISO of security firm Lumifi Cyber.

Because the information involved the company’s background checks, and drug and alcohol testing for screening its clients’ employees and perspective employees, hackers potentially obtained details pertaining to “who did and did not pass,” Hamilton said.

The drug testing information and other data stolen from DISA potentially could be used to extort or blackmail the victims, he said. “And because some of those victims may have been applicants to federal positions it may be used to turn assets into spies within federal agencies by identifying those with financial problems,” he said.

If drug and alcohol testing results were indeed exposed in the DISA breach, “then individuals’ lives and livelihoods could be impacted, including their employment status, insurance coverage, reputational damage and much more,” said Eran Barak, co-founder and CEO of data security firm, MIND.

Unfortunately, many companies often have little visibility over the full scope of their data ecosystem, including which third parties have access or are using sensitive information, he said.

Lawsuits Filed

As of Wednesday, at least a half dozen proposed federal class action lawsuits have been filed so far against DISA involving the data breach.

The lawsuits – seeking financial damages and related relief – make similar allegations against DISA, including negligence in failing to secure individuals’ sensitive personally identifiable information.

“Defendant failed to adequately protect plaintiff’s and class members’ PII – and failed to even encrypt or redact this highly sensitive information,” alleges a proposed class action lawsuit filed Tuesday in a Houston federal court by plaintiff Drew Webster on behalf of himself and others similarly situated.

“This unencrypted, unredacted PII was compromised due to Defendant’s negligent and/or careless acts and omissions and its utter failure to protect its clients’ employees’ and job applicants’ sensitive data,” the lawsuit alleges.

“Hackers targeted and obtained plaintiff’s and class members’ PII because of its value in exploiting and stealing the identities of plaintiff and class members. The present and continuing risk of identity theft and fraud to victims of the data breach will remain for their respective lifetimes.”

Vendor Risk

Meanwhile, the recent DISA data breach highlights an ongoing concerning trend in cybersecurity, the vulnerability of third-party networks, said Bob Maley, CISO of third-party risk firm, Black Kite.

“These ‘silent breaches’ often go undetected until exploited, causing significant damage across interconnected systems,” he said. A recent Black Kite research study found that third-party breaches accounted for a substantial portion of cyber incidents in 2024, with industries such as healthcare, finance and manufacturing being particularly vulnerable, he said.

Organizations that work in healthcare and interact with sensitive patient information need strong controls in place to protect sensitive information, regardless of their regulatory responsibility under HIPAA, suggested Andrew Mahler, vice president of privacy and compliance services at consultancy Clearwater.

The DISA incident “shines a light on the vast network of third parties receiving sensitive data and the need for the industry to drive greater accountability across that universe,” he said.

As hacks and security cyber incidents involving third-party vendors continue, experts recommend that these firms enhance their protection of their clients’ sensitive information, including taking a multi-layered approach to cybersecurity.

That includes continuous monitoring with tools like intrusion detection systems and security information and event management, multi-factor authentication and strong encryption practices, Maley said.

Organizations should establish “clear communication channels with clients enables the sharing of security information and facilitates coordinated incident response efforts,” he said.

Meanwhile, organizations dependent on third-party providers that process sensitive information are often limited in what they can do to gain assurance on security controls, Hamilton said.

“The options are to obtain documentation on audited controls – with an emphasis on ‘audited,’ pay for and perform an assessment of the third party against a recognized regulatory framework, or, increasingly, continuously monitor the third party through perimeter scanning and routine meetings to review progress on vulnerability management and progress on corrective actions,” he advised.

“What organizations should not do is accept self-assessments or point-in-time penetration test reports, as these are aspirational and ephemeral, respectively.”

Mahler said his firm strongly encourages clients to conduct regular security risk assessments of their vendors.

That includes assigning risk levels based on findings, implementing risk management plans, and monitoring risks on an ongoing basis – recognizing how rapidly environments change and new vulnerabilities can emerge.

“With business associates accounting for 77% of breached records in 2024, strong vendor risk management programs need to be in place, and should be assessed, monitored and updated on a regular basis.”