Paylocity paylocity.com Paylocity data breach: what happened and what to do
On November 1, 2018, names and Social Security numbers of some Group 1 Automotive employees were briefly exposed to another Paylocity client's administrator by mistake. Paylocity says the data wasn't viewed or compromised and offered 12 months of identity protection.
View all 13,115 breaches- Breach date
- Nov 2018
- Made public
- 27 Nov 2018
- Data exposed
- Names, Social security numbers
- Last updated
What happened
Paylocity, a payroll provider, handles payroll for Group 1 Automotive. On November 1, 2018, some Group 1 Automotive employees' personal information was exposed by mistake to the administrator of another Paylocity client. Paylocity says the information was exposed only temporarily and was not viewed or otherwise compromised. A notice letter dated November 28, 2018 went to the affected employees, and the incident appeared on the California Attorney General's breach list on November 27, 2018.
What was exposed
The notice says the exposed information included names and Social Security numbers. It doesn't list other details such as addresses or bank accounts. The notice doesn't say how many people were affected.
What that means for you
This wasn't an attack, and Paylocity says nobody looked at the data. Still, a name together with a Social Security number is the core of what someone needs to open credit in your name, so it's worth a few minutes of precaution if you got the letter. The risk is identity theft rather than account takeover: there are no passwords in this incident.
The company's response
Paylocity says it investigated as soon as it learned of the incident, is giving its employees extra training on handling personal information, and has added safeguards to stop messages from going to the wrong recipient. It also arranged 12 months of AllClear ID identity protection at no cost to the people who received the letter.
What to do if you were in it
- 1
Read the letter and use the free protection
If you got the November 2018 notice, it came with 12 months of AllClear ID identity protection. If the offer has lapsed, the steps below still apply.
- 2
Freeze your credit
A Social Security number was involved, so place a free credit freeze at Equifax, Experian and TransUnion. It blocks new accounts opened in your name and you can lift it whenever you apply for credit.
- 3
Check your credit reports
Pull your reports for free at annualcreditreport.com and look for accounts or inquiries you don't recognize.
- 4
Watch for tax and payroll fraud
Be alert to a rejected tax return or mail about accounts you never opened, and treat any message that mentions your payroll or employer as suspect until you've checked it with HR directly.
- 5
Check whether your email or phone is in other breaches
Run a free Serus scan to see whether your details show up in other breaches. Serus monitors breach databases and the dark web and alerts you when your data appears.
Frequently asked
Was I affected by the Paylocity breach?
Only if you were a Group 1 Automotive employee who received the notice dated November 28, 2018. The notice doesn't say how many people were involved.
What was exposed?
Names and Social Security numbers, according to the notice. Paylocity says the information was not viewed or otherwise compromised.
Should I change my password?
The notice doesn't mention passwords, so this incident doesn't call for it. A credit freeze is the step that matters here.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
