Fortrex, the sanitation and food safety services company that operated under the PSSI name until recently, was listed in October 2026 on a dark web leak site by a group calling itself Wallstreet. The group claims to have stolen data, and employee information is considered to be at possible risk.
This is an unconfirmed claim. Fortrex has not publicly acknowledged a security incident, so everything below should be read as reported, not established.
Fortrex’s Data Breach Investigation
In October 2026, a group that goes by the name Wallstreet posted Fortrex on a dark web leak site, a common first step in extortion campaigns in which attackers publicly name a victim to pressure it into paying. Monitoring services that track these sites picked up the listing, and at least one of them described Fortrex as a food safety and sanitation services company. The listing is the entire public basis for the claim at this point.
Fortrex provides cleaning and sanitation services to food processing facilities and, before adopting its current name, was widely known as PSSI. A California Attorney General settlement document from 2025 describes the company as doing business as Fortrex and as having operated formerly under the PSSI brand, which is how the two names are linked here. Because the company serves many plants and relies on a sizable workforce to do the work, a claim involving its systems raises obvious questions about employee records, although none of that has been confirmed.
Fortrex has not publicly confirmed that a cybersecurity incident occurred. The company has not issued a statement describing what happened, has not said when any unauthorized activity may have taken place, and has not said whether any information was accessed or taken. The categories of information that might be involved have not been disclosed, and no count of affected people has been published. A plaintiff-side investigation page lists Fortrex employees as the group that may have been affected, but that is an assumption about who could be at risk, not a finding.
A leak-site listing is not proof of a breach. Attackers sometimes exaggerate what they took, post names of organizations they never fully compromised, or reuse old data. Other times the claim is accurate and the company confirms it weeks later after finishing its own forensic review. Until Fortrex speaks publicly or files a notice with a regulator, there is no way to know which of those situations applies.
The timing of any notification also depends on the company, not the attacker. State breach notification laws generally start the clock when an organization determines that personal information was actually compromised, and they require notice to affected people without unreasonable delay. A public claim by a criminal group does not by itself start that clock, which is why a company may stay quiet for a time while it investigates, and why people often learn the details only when a letter arrives in the mail.
If the claim turns out to be accurate, employee data is a serious target. Payroll and human resources files can contain names, addresses, Social Security numbers, bank account details for direct deposit, and dates of birth, a combination that supports identity theft and tax-refund fraud. Former employees and job applicants can be affected too, because organizations often keep old records for years. Again, none of these data types has been tied to Fortrex. They are the kinds of information such files commonly hold, and they explain why workers pay close attention to claims like this one.
Anyone who has worked for Fortrex or PSSI, or applied for a job there, can reasonably treat this as a situation to watch. Look for any official notice, rely on the company’s own channels for confirmation, and be cautious about unsolicited messages that mention the incident.
When Did This Breach Occur?
The leak-site listing appeared in October 2026, according to the monitoring services that track these postings. That is the only date publicly associated with the claim.
Fortrex has not said when any unauthorized access may have occurred, when it first learned of a problem, or whether it has notified anyone. The date of any underlying incident is therefore not publicly known, and the October 2026 listing date should not be read as the date data was taken.
What Information Was Breached?
The information involved has not been confirmed. Fortrex has not disclosed any categories of data, and the leak-site listing itself did not publicly identify what was supposedly taken.
The plaintiff-side page that flagged the listing points to employees as the people who may be at risk. If employee records were involved, such files commonly include contact details, Social Security numbers, bank details used for payroll, and similar identifiers. That is general background, not a statement about what Fortrex actually holds or lost.
What You Can Do
You do not need to wait for a confirmation to protect yourself.
- Watch your mail and email for any notice from Fortrex or a vendor it hires to handle notifications, and confirm any message through the company’s official website before acting on it.
- Be skeptical of unexpected calls, texts, or emails that mention Fortrex, PSSI, payroll, or benefits, even if the sender knows personal details about you.
- Request your free credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com and look for accounts you did not open.
- Consider placing a free fraud alert or security freeze with each of the three credit bureaus.
- Check your bank statements and payroll direct deposit details for changes you did not make.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general.
File a Data Breach Lawsuit Against Fortrex
People whose information is taken in a security incident may have legal options if the organization failed to use reasonable safeguards or delayed telling them. Whether that applies here depends on what an investigation finds, and so far there is no confirmed incident to evaluate.
If you receive a notice from Fortrex, or you believe your personal information was involved, keep the notice and any records of suspicious activity, fraud, or time and money spent dealing with the fallout.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
