Edenred Pay, a business-payments provider formerly known as GlobalvCard, has notified individuals that their personal information may have been exposed in a recent data security incident. Companies that process financial and payment information for vendors and payees have an obligation to keep that data secure, and any lapse can put people at real risk of fraud and identity theft.
Edenred Pay’s Data Breach Investigation
GlobalvCard LLC, doing business as Edenred Pay and part of the global Edenred Group, sent notification letters to individuals whose information the company processes in connection with its accounts payable and payments services. According to the notice, an unspecified security incident allowed an unauthorized party to potentially access information associated with these individuals. Edenred Pay has not publicly disclosed the exact date the incident occurred or when it was discovered, and the notification letter does not identify a specific number of people affected.
In response, Edenred Pay reports that it took steps to address the incident and further secure its systems, including revoking compromised access credentials, securing the impacted systems and applications, and implementing enhanced monitoring tools to help detect and respond to any further suspicious activity. The company states it is not aware of any misuse of the exposed information at this time.
Data breaches involving business-payments platforms are an increasingly common target for cybercriminals, since these systems often hold a concentrated set of sensitive information, including Social Security numbers, banking and payment details, and contact information, for large numbers of vendors, employees, and business partners in a single place. A single successful intrusion into a payments processor’s network can expose the personal information of individuals who may never have directly interacted with the company at all, since the data was collected on behalf of the processor’s own corporate clients.
The combination of a full name, mailing address, and Social Security number is particularly valuable to identity thieves, because it is often enough information on its own to open new lines of credit, file fraudulent tax returns, or apply for loans in a victim’s name. Unlike a stolen credit card number, which can simply be canceled and reissued, a compromised Social Security number cannot be changed, which means the risk of misuse can persist for years after the initial incident.
Companies that experience a data security incident typically conduct a forensic investigation before notifying affected individuals, a process that can take weeks or months to determine the scope of what was accessed and who was impacted. While Edenred Pay’s notification does not provide a detailed timeline of its investigation, offering credit monitoring services in the aftermath of an incident like this is a standard step companies take once they have identified the individuals whose information may have been compromised.
Affected individuals should treat this notice seriously even though Edenred Pay has stated it has no evidence of misuse to date. Identity thieves do not always use stolen information immediately, and a delay between a breach and any resulting fraud is common, which is part of why ongoing credit monitoring and account vigilance is recommended for an extended period after a notice like this one.
When Did This Breach Occur?
Edenred Pay’s notification letter does not specify the exact date the security incident occurred or the date it was discovered. The company has not made this information public as of this notice.
What Information Was Breached?
According to Edenred Pay, the information impacted appears to have included the affected individual’s name, mailing address, and Social Security number.
What You Can Do
Edenred Pay is offering affected individuals two years of Single Bureau Credit Monitoring, Single Bureau Credit Report, and Single Bureau Credit Score services at no charge through Cyberscout, a TransUnion company. If you received a notice from Edenred Pay, consider taking the following steps:
- Enroll in the complimentary credit monitoring services offered in your notification letter before the enrollment deadline.
- Review your bank and credit card statements regularly for any unauthorized activity.
- Consider placing a fraud alert or credit freeze on your credit file with Equifax, Experian, and TransUnion.
- Request a free copy of your credit report at annualcreditreport.com and review it for accounts you do not recognize.
- Remain alert for phishing emails or calls referencing this incident.
File a Data Breach Lawsuit Against Edenred Pay
If you received a notice that your personal information was exposed in the Edenred Pay data breach, you may be entitled to compensation. Companies that collect sensitive personal information have a legal responsibility to protect it, and when a data breach occurs, affected individuals often bear the ongoing burden of monitoring their accounts and protecting themselves from identity theft.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
