ZeroedIn Technologies breach exposed data of about 2 million Dollar Tree workers

ZeroedIn Technologies, a Maryland workforce analytics provider, disclosed in late November 2023 that an intruder had reached its network months earlier. The company said unauthorized access took place on August 7 and 8, 2023, and that files containing personal information were viewed or taken during that window.

Accounts of the detection timeline differ. ZeroedIn's notification, as summarized by JD Supra, said suspicious activity was identified on August 23 and the review of affected files finished on August 31. SecurityWeek reported the company identified the incident on August 8. Notification letters went out on November 27, 2023.

The exposed data varied by person and could include names, dates of birth and Social Security numbers. Because ZeroedIn supplied human resources analytics to Dollar Tree and Family Dollar, most of those affected were applicants and current or former employees of the two discount chains rather than ZeroedIn's own staff. Filings put the total at 1,977,486 people, generally reported as about two million.

ZeroedIn said it secured its systems, completed an investigation and notified those affected. Plaintiffs' firms began soliciting claims within days, and class action suits alleging negligence were subsequently filed against the vendor.