Paychex paychex.com Paychex data breach: what happened and what to do
In 2024 Paychex told people that an unclaimed property listing with names and Social Security numbers was inadvertently sent to an unauthorized person on 22 March 2024. Paychex learned of it on 30 April and offered a year of free IDX monitoring.
View all 13,115 breaches- Breach date
- 22 Mar 2024
- Made public
- 9 May 2024
- Data exposed
- Names, Social security numbers
- Last updated
What happened
Paychex, the payroll and HR services company, told people in May 2024 that their personal information had been sent to the wrong person. According to the notice letter Paychex filed with the California Attorney General, the company learned on 30 April 2024 that a listing of unclaimed property had been inadvertently provided to an unauthorized individual on 22 March 2024. The listing came from the process of exchanging unclaimed property information with the State of California, which companies are required to do by law.
This was not described as a hack. The notice says the file went to someone who should not have had it. The state notices do not say how many people were affected, and Paychex has not published a total.
What was exposed
The letter says the personal information involved was full name and Social Security number. Those two items together are the core of what identity thieves need to open credit or file a fake tax return in someone's name, so the exposure matters even without passwords or card numbers.
What Paychex offered
Paychex offered affected people one year of credit monitoring, dark web monitoring and recovery services through IDX at no cost, with identity theft insurance of up to $1,000,000 for expenses after a confirmed theft. The letter includes an enrollment code and an IDX phone number. Check your letter for the deadline.
What it means for you
If you got the letter, your name and Social Security number were involved. A Social Security number can't be changed in practice, so the useful defense is to make it harder to use: freeze your credit at Equifax, Experian and TransUnion, enroll in the free monitoring, and watch your accounts and any tax or benefits mail.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion. You can lift it when you need to apply for credit.
- 2
Enroll in the free IDX monitoring
If you got a letter, the enrollment code is on it. Paychex offered 12 months of credit monitoring and recovery services through IDX.
- 3
Watch statements and tax mail
Check bank and card statements, benefit letters and any IRS notices. Consider an IRS Identity Protection PIN to block fake tax returns.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases and the dark web for your email and phone number and tells you which leaks include them, so you know which passwords to change first.
Frequently asked
Was I affected by the Paychex breach?
People affected were sent a notice letter. Paychex's notice doesn't give a total, so if you haven't had a letter, you are probably not in this group. The number on the notice answers questions.
What was exposed in the Paychex breach?
According to the notice, full names and Social Security numbers.
Is there a Paychex data breach settlement?
A class action was filed in July 2024 in federal court in New York, according to press coverage. No settlement has been reported.
What caused it?
The notice says an unclaimed property listing was inadvertently provided to an unauthorized individual. It did not describe a hack.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
