KemperSports breach exposed Social Security numbers of over 62,000 people

KemperSports, an Illinois-based golf course management and hospitality operator, disclosed in September 2024 that a cyberattack had exposed the personal information of more than 62,000 people. The company runs over 140 properties across more than 30 states and employs roughly 7,500 staff.

According to the notice KemperSports filed with the Maine Attorney General's Office, it identified suspicious activity on its network on April 1, 2024. The investigation that followed confirmed an intruder had reached systems holding names and Social Security numbers. Most of those affected were current and former employees rather than golfers or venue guests.

The company said it had no evidence the information had been used for identity theft or fraud. It offered affected individuals one year of credit monitoring and identity restoration services at no cost.

No ransomware group publicly claimed the intrusion, and KemperSports did not describe how the attacker first gained access. SecurityWeek noted that this was the company's second breach disclosure in roughly a year, following an earlier incident in which two employee email accounts were accessed. Notification letters went out about five months after the activity was first detected.