DISA Global Solutions Data Breach Investigation
The data theft lawyers at The Lyon Firm are investigating a recent data breach incident reported at DISA Global Solutions, Inc. In which the company experienced a security breach that has potentially compromised the personal information of hundreds of thousands of individuals. Contact our legal team for a free case review and to discuss how to file a class action data privacy lawsuit.
Our team of data privacy attorneys has filed numerous data breach lawsuits in the last few years, and we represent plaintiffs in all fifty states. Call for a consultation and to learn more about how to protect yourself following a data breach.
What Happened at DISA Global Solutions?
Back in April 2024, DISA allegedly discovered that it was the target of a cyberattack that impacted a portion of its network. The company began an initial investigation with third-party forensic experts and later determined that an unauthorized third party accessed their IT “external system” between February 9, 2024, and April 22, 2024. According to sources, the hacker may have accessed and stolen up to 3.3 million files that contained individuals’ personal information.
According to the company notice, the personal information contained in these files may have included name, social security number, driver’s license number, other government ID numbers, and financial account information.
The breach was recently disclosed to the Massachusetts Attorney General’s office on February 22, 2025, and noted that the breach impacted 360,473 people in Massachusetts alone.
Did DISA Pay a Ransom Following the Cyberattack?
DISA may have paid a ransom following this attack last year, in an attempt to mitigate the the losses of such a large amount of personal data. At any given time, the company handles a large amount of personally identifiable information, contact details, employment and education history, criminal and background checks, drug and alcohol testing data, medical and health-related data, and more.
While the company has not shared what type of security breach they experienced, a now-deleted notice indicates that they may have paid a ransom demand to prevent the stolen data from being publicly released on the web. DISA indicated it took “measures to dissuade the threat actor from publicly releasing any acquired data and to provide confirmation of the deletion of the data,” according to a copy of the now-deleted notice.
DISA is an employee screening solutions provider based in Texas, offering drug and alcohol testing, background screening, occupational medicine and testing, safety training and transportation compliance. Due to the amount of data gathered by such firms, background check companies are prime targets for cybercriminals. DISA has over 55,000 customers over a wide range of industries, and almost a third of of Fortune 500 companies rely on DISA services. This data breach could have deeper consequences nationwide than is currently reported.
We believe that any organization that collects and stores sensitive personal data has a duty to protect it with reasonably secure and robust IT systems. If a company is found negligent in safeguarding clients’ personal information and a data theft incident results in damages, a company be held accountable. Plaintiffs can seek compensation for any related damages.