CTG, formally Computer Task Group, Incorporated, an information technology services and staffing company, appears in the Vermont Attorney General’s security breach notices. The listing reports 48 affected Vermont residents and several sensitive data categories.
CTG’s Data Breach Investigation
CTG is the commonly used name of Computer Task Group, Incorporated, an information technology services and staffing company based in Buffalo, New York. According to its own website, CTG is now part of Cegeka, a Belgian IT services group, and works with clients across North America and Europe. The Vermont entry was filed under the name Computer Task Group, Incorporated in the other commercial businesses category.
CTG appears in the security breach notices published by the Office of the Vermont Attorney General. Vermont requires a business or organization that suffers a security breach involving residents’ personal information to notify the Attorney General, and the office posts a public summary of those reports. The entry for CTG lists 48 Vermont residents were affected.
That Vermont figure is not a total. State attorney general summaries usually count only the residents of that particular state, and an organization that sends notices in several states may report a different number to each. No overall count of affected people has been published in the sources reviewed for this page, and this page does not estimate one.
The sources reviewed also do not describe how the incident happened, which systems were involved, or whether information was accessed, copied or only exposed. the company has not published a detailed public statement that we could find, and the Vermont entry is a short summary rather than a narrative account. Where a fact is not publicly available, this page says so rather than guessing, and it will be reviewed if the organization or a regulator releases more detail.
The Vermont entry lists the category of information involved as Social Security Numbers, Government ID Numbers, Financial Account Codes, Credit and Debit Account Info, Health Records. It does not say which individuals were affected in that way, how long the information was exposed, or whether any of it has been misused.
The Vermont summary lists five categories at once: Social Security numbers, government ID numbers, financial account codes, credit and debit account information, and health records. When that many categories are involved, the combined data is enough for someone to open accounts, file false tax returns or make convincing phone calls. It is sensible to consider a credit freeze, to ask the IRS for an Identity Protection PIN, and to review insurance statements for services you did not receive.
A company that places technology workers and manages IT projects for other businesses typically holds a large amount of personnel information, including employment records, tax and payroll details, benefits and identity documents. That is general context about the industry, not a statement about which records were involved here. People affected by an incident at a staffing or services provider can include current and former employees, contractors, job applicants and the employees of client organizations.
Anyone who received a notice letter from the company should read it closely. The letter is the best source for what happened in your case, what information of yours was involved, and what protective services, if any, are being offered. Keep the letter, the envelope and any enrollment instructions in a safe place, and note any deadline to sign up for monitoring.
Notification laws in most states require an organization to tell affected people about a breach without unreasonable delay, and many require the notice to describe the type of information involved. Because notices often go out well after an incident is discovered, receiving a letter does not necessarily mean the underlying event just happened. It is worth checking your accounts and credit reports promptly no matter how long ago the incident may have been.
A report to a state regulator is a sign that the organization concluded the event met the legal definition of a reportable breach. It is not, by itself, a finding about fault or about whether the safeguards in place were adequate. Those questions remain open on the public record, and they are the kind of questions that attorneys can ask on behalf of people who were harmed.
When Did This Breach Occur?
The Vermont Attorney General’s summary shows that the notice was reported to that office on October 19, 2026. The sources reviewed do not state when the incident itself occurred or when it was discovered. The date a notice is reported to a regulator is usually later than the incident, sometimes by months.
The summary does not say whether the people affected were employees, contractors, applicants or others, and it does not say which of the listed categories applies to which person. If you received a letter, its dates and description are the most reliable record of the timeline for your own information.
What Information Was Breached?
The Vermont Attorney General’s summary lists the category of information involved as Social Security Numbers, Government ID Numbers, Financial Account Codes, Credit and Debit Account Info, Health Records. No further detail about specific data fields has been published in the sources reviewed.
The notice letter you receive should state which of your details were involved. Until then, it is prudent to treat related information you provided to the company as potentially at risk.
What You Can Do
If you received a notice related to CTG or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Consider requesting an Identity Protection PIN from the IRS at irs.gov to help prevent fraudulent tax filings.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against CTG
If you received a notice about this incident, or believe your personal information was exposed, you may have legal options. Organizations are expected to safeguard the personal information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
