Cardinal Services Reports Data Breach to Maine Regulators

Cardinal Services, Inc., Cardinal Employer Organization, and Preferred Employer Solutions, collectively operating as Cardinal, function as professional employer organizations (PEOs) and human resources outsourcing providers. They manage essential administrative functions such as payroll, benefits, and tax filings for numerous businesses. On May 20, 2026, Cardinal notified the Maine Attorney General about a data security incident where unauthorized parties gained access to its network infrastructure.

Due to its specialized role, Cardinal routinely collects, processes, and stores vast quantities of confidential employee information on behalf of its client companies and their workers. This includes sensitive Personally Identifiable Information (PII) and financial records. Breaches in such organizations often stem from sophisticated cyberattacks, including unauthorized access to databases or vulnerabilities within third-party software.

The exposed data categories reported include Full Name, Social Security Number, Date of Birth, Wage and Compensation Information, Tax Return Information, Direct Deposit Account Details, Home Address, and Employee ID Number. The compromise of Full Name, Social Security Number, and Date of Birth can facilitate identity theft and fraudulent account openings. Exposure of Wage and Compensation Information, Tax Return Information, and Direct Deposit Account Details increases the risk of tax fraud and unauthorized access to financial accounts.

Individuals who receive notification about this incident should consider monitoring their financial accounts and credit reports for suspicious activity. Placing a fraud alert or freezing credit with major credit bureaus are general steps to help protect against potential misuse of personal information. Reviewing tax returns carefully for any signs of fraud is also advised.