Dentsu’s customer experience unit, Merkle, suffered a cyberattack resulting in the theft of sensitive employee data, including bank/payroll details, salaries, National Insurance numbers, and contact information for current and former employees (some dating back over a decade). The breach triggered legal action, with over 150 ex-employees organizing via WhatsApp to pursue group litigation, alleging Dentsu’s failure to implement adequate security or comply with data retention policies. The UK’s Information Commissioner’s Office (ICO) is investigating, with potential fines up to 2% of global turnover or multi-million-dollar penalties. While Dentsu engaged cybersecurity firms and offered credit/dark-web monitoring, affected individuals report unclear communication about exposed data, heightening fraud risks. The incident compounds Dentsu’s reputational and financial strain, coinciding with an unrelated money-laundering probe in India linked to a third-party acquisition (InDeed), though no direct connection to the Merkle breach was established.

Merkle, a US-based subsidiary of the Japanese multinational advertising giant Dentsu, suffered a cyberattack resulting in the exposure of sensitive data. The breach compromised files containing personal, payroll, and National Insurance details of current and former employees, as well as supplier and client data. The company took immediate action by shutting down certain systems to contain the attack and initiated an investigation with external cybersecurity experts. While the financial impact remains unclear, affected individuals are being notified and offered free dark web monitoring. The attack did not affect Dentsu’s systems in Japan, but the scale of the breach raises concerns given Merkle’s global workforce of over 16,000 employees and annual revenue of approximately $1.5 billion. No ransomware group has claimed responsibility, leaving the attack method unspecified beyond confirmation of data exfiltration.

Merkle Inc. Data Breach Exposes Sensitive PII in 2025 Cyberattack Merkle Inc., a global performance marketing and customer experience management firm under dentsu, disclosed a data breach involving unauthorized access to its servers. The incident was detected on August 31, 2025, prompting an immediate response, including containment efforts and an investigation with a third-party cybersecurity firm. By January 27, 2026, Merkle confirmed that compromised files contained sensitive personally identifiable information (PII), including names and Social Security numbers. The company reported the breach to the New Hampshire Attorney General’s office on February 6, 2026, and began mailing notification letters to affected individuals. As of the disclosure, one New Hampshire resident has been confirmed as impacted. Merkle is offering affected individuals a 12-month complimentary Experian IdentityWorks membership, which includes credit monitoring, identity restoration support, and up to $1 million in identity theft insurance. Legal firm Shamis & Gentile P.A. is investigating potential compensation claims for those affected. The breach highlights ongoing risks in data security, particularly for companies handling large volumes of customer information.