OnTrac Final Mile Investigates Data Breach Impacting Customer Data Shamis & Gentile P.A., a class action law firm specializing in data breach cases, is examining a cybersecurity incident involving OnTrac Final Mile, a major U.S. logistics and last-mile delivery provider. The breach, detected on March 23, 2026, involved unauthorized access to corporate files between March 20 and March 22, 2026, following suspicious network activity. OnTrac, formed by the merger of LaserShip and OnTrac, operates a nationwide delivery network and is headquartered in Chantilly, Virginia. The company confirmed that names were exposed in the breach, though additional details about the scope of compromised data remain unconfirmed. On July 22, 2026, OnTrac reported the incident to the California Attorney General and began notifying affected individuals, offering complimentary credit monitoring and identity protection services. This breach is distinct from a separate April 2025 incident, which is currently subject to ongoing class action litigation. Legal representatives are assessing potential compensation for impacted individuals.

In April 2025, U.S. delivery company OnTrac suffered a data breach exposing sensitive personal information of over 40,000 individuals. The compromised data included names, dates of birth, Social Security numbers, driver’s license or state IDs, and medical/health insurance details. Attackers accessed the company’s network between April 13th and 15th, 2025, though OnTrac claims the data was re-secured and not distributed, with no evidence of misuse or fraud thus far. Despite this, the exposed information could enable malicious activities such as medical identity theft (e.g., fraudulent insurance claims, prescription drug resale), financial fraud (e.g., fake bank accounts, tax returns), or benefits theft. OnTrac responded by offering affected individuals 12 months of free credit monitoring and identity protection services via TransUnion and CyberScout. While the company acted swiftly to mitigate risks, the breach highlights the persistent threat of identity theft and the need for vigilance against phishing and social engineering attacks.