ComplyRight data breach: what happened and what to do

Between April 20 and May 22, 2018, an unauthorized party accessed ComplyRight's tax form website. ComplyRight said some recipients of 1099 and W-2 forms were affected, with names, addresses and Social Security numbers among the data. It offered 12 months of credit monitoring.

View all 13,177 breaches

Breach date: 20 Apr 2018
Data exposed: Names, Physical addresses, Phone numbers, Email addresses, Social security numbers
Last updated: 25 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

ComplyRight is a human resources and tax compliance company. Its website lets businesses prepare and file tax forms such as 1099s and W-2s. In 2018 it told people that an outside party had gained access to that site.

What happened

ComplyRight says it learned of the problem on May 22, 2018. Its forensic investigators found that the site had been accessed without authorization from April 20 to May 22, 2018. The company said it could not confirm whether the data was actually downloaded.

The company said the incident affected "a portion (less than 10%)" of the people who had tax forms prepared on its platform, and it didn't publish a total. Reporters noted that the notice letters came from a company many recipients had never heard of, because the people on the forms are workers and contractors, not ComplyRight's own customers.

Sources checked: darkreading.com, krebsonsecurity.com, scworld.com

Last verified against the official page: 25 Oct 2026

How we research this Report an error

What was exposed

Reporting on the notices lists names, addresses, phone numbers, email addresses and Social Security numbers, taken from tax forms such as 1099 and W-2 forms.

What that means for you

Social Security numbers on tax forms give criminals what they need for tax refund fraud and new-account fraud. If you've ever received a 1099 or W-2 prepared by an employer or client that used an online filing service, a notice like this could reach you without you knowing the company.

ComplyRight offered 12 months of free credit monitoring and identity theft protection to people it notified. A class action followed in federal court. The steps below apply whether or not you got a letter.

What to do if you were in it

1

Freeze your credit at all three bureaus

A credit freeze stops new accounts from being opened in your name. It's free, and you place it separately with Equifax, Experian and TransUnion. The FTC explains how in its guide to credit freezes and fraud alerts.
2

Get an IRS Identity Protection PIN

Because tax forms were involved, ask the IRS for an Identity Protection PIN. It stops someone else from filing a return with your Social Security number. The IRS explains how on its Identity Protection PIN page.
3

Read your statements and credit reports

Look for charges or accounts you don't recognize. You can get your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov, the FTC's reporting site.
4

Treat messages that mention the breach with suspicion

Criminals send fake notices that use real breach details. Don't click links or call numbers in an unexpected email, text or letter. Go to the company's website yourself, or use a phone number you already trust.
5

Check whether your email or phone number shows up in this and other breaches

A free Serus scan checks your email and phone number against breach databases and tells you what to do about anything it finds. Serus can't remove data from a breach, but it alerts you when new exposures appear.

Official filings

Washington Attorney General , filed 13 Jul 2018 : 29,322 people

Timeline

20 Apr 2018
The breach happened
13 Jul 2018
Reported to the Washington Attorney General

Frequently asked

Was I affected by the ComplyRight breach?

ComplyRight mailed notices to the people it believes were affected. If you received a 1099 or W-2 in 2017 or 2018 and got a letter from ComplyRight, you were. If you didn't get a letter, you can still take the steps on this page.

What was exposed in the ComplyRight breach?

Names, addresses, phone numbers, email addresses and Social Security numbers from tax forms such as 1099 and W-2 forms.

How many people were affected?

ComplyRight said less than 10% of the people with forms prepared on its platform were affected and didn't give a total. Some news reports cite other figures, so treat any exact number with caution.

Should I freeze my credit?

If your Social Security number was on an affected form, the FTC recommends considering a credit freeze. It's free and reversible.