First Advantage fadv.com First Advantage data breach: what happened and what to do
First Advantage, a background screening company, said an attacker phished an employee's account around November 13, 2025 and copied the inbox. Notices began in April 2026. Names, Social Security numbers and driver's license details were involved. No total count is public.
View all 13,115 breaches- Breach date
- 13 Nov 2025
- Made public
- 22 Apr 2026
- Data exposed
- Names, Social security numbers, Driver's licenses
- Last updated
What happened
First Advantage runs background and drug screening for employers. According to Teiss, an attacker accessed one employee's account in its drug and occupational health screening unit around November 13, 2025, through a phishing attack, and copied that employee's email inbox. First Advantage found the intrusion on November 17, 2025, disabled the account and strengthened its security.
It notified people in spring 2026, with letters reported from April 22, 2026. A copy of the notice was filed with the California Attorney General. First Advantage hasn't published a total number of people affected.
Why you may have gotten a letter
You don't need to have dealt with First Advantage. If an employer screened you as a job applicant or employee, your details may have been in that employee's inbox. Some employers also notified their own staff.
What was exposed
Filed notices list names, Social Security numbers and driver's license information. First Advantage says it isn't aware of any fraud or misuse of the data.
A name plus Social Security number is what criminals need to open credit or file a tax return in your name, and the risk can show up months later.
The company's response
First Advantage is offering two years of complimentary credit monitoring and identity restoration through Cyberscout, a TransUnion company.
What to do if you were in it
- 1
Freeze your credit
Placing a freeze at Equifax, Experian and TransUnion stops most new accounts being opened in your name. It's free and you can lift it when you need credit (FTC guide).
- 2
Sign up for the free monitoring
If you got a letter, use the enrollment code for the two years of Cyberscout monitoring and identity restoration.
- 3
Get an IRS Identity Protection PIN
Because your Social Security number may be exposed, an IRS IP PIN helps stop someone filing a tax return as you.
- 4
Watch for messages about your job application
Be careful with emails or texts that mention a background check, an employer or your data. Contact the employer using details you already have.
- 5
Check other breaches
Check whether your email or phone number shows up in this and other breaches. A free scan from Serus looks across breach databases and the dark web and alerts you when your data appears.
Frequently asked
Was I affected by the First Advantage breach?
Only people who got a notice letter were told they were affected. If an employer screened you and you got no letter, ask the employer or First Advantage.
Why did a screening company have my data?
Employers use screening companies for background and drug checks, so they hold applicants' and employees' details.
What was exposed?
Filed notices list names, Social Security numbers and driver's license information.
Should I freeze my credit?
If your Social Security number was in your letter, yes. It's free at all three bureaus.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
