Job Shop data breach exposes thousands to identity theft risks

The Job Shop, a nationwide staffing and employment agency owned by Forest & Einstein Staffing, confirmed that a cybercriminal gained access to one of its servers earlier this year, potentially exposing the personal information of thousands of individuals.

The company said it was first notified of the breach on Aug. 14, 2025, by its third-party IT services vendor. An investigation found that the intruder accessed a remote desktop server around mid-June. The compromised server contained completed Forms W-2 for 2018, 2019 and 2020, raising concerns that names, addresses and Social Security numbers may have been exfiltrated. Officials have not disclosed the exact number of people affected.

A ransomware group calling itself PEAR has claimed responsibility for the attack, boasting on a dark web site that it leaked 135 gigabytes of data. The group said the stolen files included financial records, personally identifiable and health information, vendor and partner details, client data and complete email correspondence. The posting indicated both a ransomware demand and a public data leak, escalating the risk for those impacted.

The Job Shop reported the breach to the Massachusetts Attorney General’s office on Sept. 29 and has started sending notification letters to affected individuals. In response, the company is offering 24 months of free credit monitoring and identity theft protection through Equifax Credit Watch Gold. The package includes credit monitoring with alerts, daily access to Equifax credit reports, web scans for compromised personal data, automatic fraud alerts, identity restoration services and up to $1 million in identity theft insurance.

Legal scrutiny is also mounting. Shamis & Gentile P.A., a class action law firm that frequently investigates data breach cases, announced it is reviewing the incident and exploring potential claims on behalf of those affected.

Founded in 1986 and headquartered in Kentucky, The Job Shop provides contract, permanent, temporary and temp-to-perm staffing solutions for businesses nationwide. The company helps employers manage workforce needs by matching them with qualified entry-level, skilled and professional talent.

Individuals who receive a breach notification are urged to enroll in the free protection services, monitor financial accounts closely and remain cautious of phishing attempts or fraudulent activity tied to their personal information.