OnTrac reports major cyber security incident, customer data compromised

U.S.-based parcel logistics company OnTrac has disclosed a major cybersecurity breach after threat actors infiltrated its internal network and exfiltrated sensitive personal information of customers.

 

Headquartered in Vienna, Virginia, OnTrac is an American parcel logistics and last-mile delivery company that provides residential and commercial parcel delivery services across much of the United States through an extensive regional network. Serving retailers, e-commerce businesses, and direct-to-consumer brands, the company focuses on fast, cost-effective shipping solutions and competes with major carriers in the expanding last-mile delivery market.

 

In a data security incident notice, OnTrac said that on March 23, it identified unauthorised access within a limited portion of its internal network. The parcel delivery company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to secure the affected systems and notified relevant law enforcement authorities about the same.

 

“The investigation determined that certain files may have been accessed without authorisation between March 20 and March 22, 2026,” OnTrac said.

 

The compromised data included names and other personal identifiers including Social Security numbers. The company is yet to share the number of affected individuals.

 

“We are not aware of any fraud or publication of stolen information resulting from this incident, nor do we have any reason to believe any such misuse of information will occur,” OnTrac added.

 

The parcel delivery company has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered one year of complimentary credit monitoring and identity protection services to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on OnTrac. The logistics company also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.