Diligent diligent.com Diligent data breach 2022: what happened and what to do
Around May 21, 2022, an unauthorized party accessed a network supporting Steele Compliance, a firm Diligent acquired in 2021. Diligent notified people from June 2022 and sent more notices in February 2023. Data included names, addresses, email addresses or Social Security numbers.
View all 13,115 breaches- Breach date
- 21 May 2022
- Data exposed
- Names, Email addresses, Physical addresses, Social security numbers
- Last updated
What happened
Diligent Corporation, a governance software company, said an unauthorized actor accessed a network supporting Steele Compliance, a firm Diligent acquired in February 2021. The access began around May 21, 2022. Diligent discovered it on May 23 and contained it by May 24.
Diligent began notifying people on June 22, 2022. Its report to the Maine Attorney General then counted 1,184 people and offered 24 months of credit monitoring. In early February 2023 it sent new notifications to state attorneys general after additional people's information turned out to be involved. According to DataBreaches.net, the full scope became clear when the stolen files appeared on an external site. A notice also appears on the California Attorney General's list.
What was exposed
Reporting on the notices says the data included names, email addresses, mailing addresses or Social Security numbers, depending on the person. One source describes the affected system as a human resources system. Read your own letter for what applies to you.
What it means for you
If a Social Security number was involved, the risk is identity theft: someone opening credit in your name, sometimes long after the breach. Names with addresses and emails support targeted phishing.
The company's response
Diligent offered credit monitoring and widened its notices in 2023. Reporting says it agreed to a class action settlement of up to $200,000. Check the official settlement notice for terms and deadlines before filing a claim.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
If your letter lists a Social Security number, a free freeze at Equifax, Experian and TransUnion blocks most new accounts in your name.
- 2
Use the credit monitoring in your letter
Diligent offered credit monitoring. Check your notice for the activation code and deadline.
- 3
Watch statements and credit reports
Look for accounts or charges you don't recognise, and check the free reports at annualcreditreport.com.
- 4
Treat unexpected emails that mention the breach with suspicion
Criminals use breach details to make scam emails look real. Don't click links in a message you didn't expect. Go to the company's site by typing the address yourself.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and Serus monitors the dark web and breach databases and alerts you when your details turn up again. Breach data can't be taken back once it has leaked, so the scan tells you what to change, not what to delete.
Frequently asked
Was I affected by the Diligent data breach?
Diligent sent letters in June 2022 and more in February 2023. If you got one, you were included. Check your notice for what applied to you.
What was exposed in the Diligent breach?
Names, email addresses, mailing addresses or Social Security numbers, depending on the person, according to reporting on the notices.
How many people were affected by the Diligent breach?
The first Maine filing counted 1,184 people. Diligent later notified more people, and the notices put the count at different levels over time.
Is there a settlement for the Diligent breach?
Reporting says Diligent agreed to pay up to $200,000 to settle a class action. Check the official settlement site for deadlines.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
