Infosys Data Breach Exposes Sensitive Employee Data via Third-Party Vendor A data breach at Infosys Ltd., a global IT services and consulting giant, has exposed sensitive personal and financial information of employees through a third-party vendor. The incident, traced to ESOP Direct the administrator of Infosys’ employee share scheme occurred on October 29, 2025, but was only disclosed to the Massachusetts Attorney General’s office on March 12, 2026. The breach compromised data belonging to at least 17 Massachusetts residents, though the total number of affected individuals across other states remains unspecified. Exposed information includes names, addresses, phone numbers, transaction receipts, bank identifier codes, payment amounts, bank account details, and government IDs. Infosys, headquartered in Bengaluru, India, is a Fortune 500 company with over 250,000 employees and operations in 50+ countries, providing IT services, digital banking solutions, and consulting. The firm, listed on the New York Stock Exchange, has faced scrutiny as legal teams investigate potential compensation claims for affected individuals. The incident highlights risks associated with third-party vendors handling sensitive employee data, particularly in global enterprises. Further details on the breach’s scope and remediation efforts are pending.