Employee screening company DISA confirms a data breach in February 2024, found in April 2024, affecting 3.3M+ people and including Social Security numbers
DISA Global Solutions, a U.S.-based provider of employee screening services, has said it suffered a data breach that affects more than 3.3 million people.
Context & Ripple Effects
DISA’s disclosure extends a recurring security problem among companies that aggregate identity data for screening and lookup services. Earlier coverage included the alleged 2019 customer database leak at TruthFinder and Instant Checkmate and National Public Data’s confirmation of a breach after stolen records were leaked in 2024.
The common exposure of Social Security numbers makes these incidents consequential beyond the original service relationship: data collected for employment or public-records uses can become durable identity-risk material once compromised.
First-order effects
- More than 3.3 million affected people face exposure of Social Security numbers, raising the immediate stakes of a breach at a firm handling employment-screening information.
- DISA must manage breach response and scrutiny from the people and organizations that supplied or rely on its screening data.
Second-order effects
- Employers and other customers that use screening vendors may reassess vendor security controls and incident-notification practices, particularly after National Public Data confirmed a breach involving sensitive personal information.
- Rival screening and background-data providers face stronger pressure to demonstrate how they protect high-value identifiers, while affected individuals may encounter heightened fraud and identity-verification friction.
Third-order effects
- If breaches continue across data-broker and screening services, the sector’s ability to retain broad, sensitive identity datasets will face a deeper trust and governance challenge rather than being treated as isolated vendor incidents.
- The pattern strengthens the case for tighter boundaries on collection, retention, and reuse of public and employment-related personal data, though the corpus does not establish a particular policy response.
The trend: Repeated breaches at identity-data intermediaries are making the security and retention of aggregated personal records a core constraint on the background-data industry.