CB Squared Services, Inc., a Fredericksburg, Virginia company that operates Jiffy Lube franchise locations across Virginia and Maryland, has notified regulators that unauthorized access to its computer network exposed sensitive personal information, including names and Social Security numbers. Companies that maintain this type of data have a responsibility to protect it and to notify affected individuals promptly once a breach is discovered.
CB Squared Services’s Data Breach Investigation
CB Squared identified unusual activity within its computer network and, upon discovering the activity, took steps to secure its systems and commenced an investigation. The company engaged a cybersecurity firm experienced in responding to similar incidents to assist with the review. According to a notice filed with the New Hampshire Attorney General’s Office, the investigation determined that unauthorized access to CB Squared’s network occurred between April 30, 2026, and May 7, 2026, during which time copies of certain files were taken from the company’s systems.
It was not until June 25, 2026, nearly two months after the intrusion began, that CB Squared determined the files taken during the incident contained the names and Social Security numbers of affected individuals. This gap between the initial unauthorized access and the confirmation of what specific data was exposed is common in breach investigations, since forensic review of large volumes of potentially affected files can take considerable time to complete accurately. CB Squared has not publicly disclosed how the unauthorized party first gained access to its network, nor has it disclosed the full number of individuals affected nationwide beyond the single New Hampshire resident addressed in its regulatory filing.
Businesses that operate franchise or service locations, like CB Squared’s network of automotive service centers, often maintain centralized computer systems that store customer and employee records across multiple physical locations. This centralization can make a single network intrusion far more consequential than a breach affecting just one storefront, since a successful attack on the central system can expose records tied to customers and employees across an entire regional footprint.
The combination of a person’s name and Social Security number is considered one of the most sensitive categories of exposed data, since it is frequently sufficient by itself to open fraudulent credit accounts, file false tax returns, or otherwise impersonate the affected individual with government agencies and financial institutions. Cybercriminals who successfully extract this type of data from a company’s network often sell it on dark web marketplaces, where it can be purchased and used by other bad actors long after the original breach occurred.
CB Squared has taken additional steps to enhance its security measures following the incident and is offering the affected individual a complimentary membership to credit monitoring and identity protection services. The company has also established a dedicated, toll-free call center that individuals can contact to obtain more information about the incident and available protective resources.
Data breach notifications like the one filed by CB Squared are typically required under state law within a specific window following discovery of the incident, giving affected individuals the opportunity to take protective action as quickly as possible. Companies that delay notification beyond what is legally required, or that fail to adequately secure customer data in the first place, can face increased scrutiny from regulators and potential liability to the individuals harmed by the exposure.
When Did This Breach Occur?
According to CB Squared’s notification, unauthorized access to its network occurred between April 30, 2026, and May 7, 2026. The company determined on June 25, 2026 that files taken during the intrusion contained affected individuals’ personal information, and mailed a notification letter to the affected New Hampshire resident on July 7, 2026.
What Information Was Breached?
CB Squared’s notification states that the files accessed during the incident contained the affected individual’s name and Social Security number. The company is offering a complimentary membership to Epiq Privacy Solutions ID 3B Credit Monitoring to individuals whose information was affected.
What You Can Do
If you received a notification letter from CB Squared Services, consider taking the following steps to protect yourself:
- Enroll in the complimentary credit monitoring services offered in your notification letter.
- Request free copies of your credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com.
- Consider placing a fraud alert or credit freeze on your credit files.
- Monitor your financial accounts closely for unauthorized activity.
- Report any suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against CB Squared Services
If you were affected by the CB Squared Services data breach, you may be entitled to compensation for the exposure of your personal information. Companies that fail to adequately protect sensitive customer data can be held accountable for the resulting harm.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
