OnTrac tells customers hackers were inside its network for three days in March
The last-mile delivery firm hints at a quiet deal with its attackers, but no ransomware crew has claimed the hit.
Key points
- OnTrac, a US last-mile parcel delivery company, says hackers were inside its corporate network between 20 and 22 March 2024.
- The intrusion was spotted on 23 March, and files containing customer names and other redacted personal details were accessed.
- OnTrac says the stolen data was "re-secured and not distributed", wording that typically points to a ransom payment.
- No ransomware group has claimed the attack, and OnTrac has not said how many customers are affected.
- Affected customers are being offered 12 months of free credit monitoring through CyberScout, with 90 days to enrol.
OnTrac, the US parcel-delivery company handling roughly 70% of last-mile e-commerce drops, is writing to customers to say hackers got into its corporate network in March and took files containing their personal information.
Formed in 2021 from the merger of OnTrac Logistics and LaserShip, the firm runs 102 depots across 35 states and works with more than 7,000 independent drivers. If you've ever had a package from Amazon or a similar retailer land on your doorstep on the East or West Coast, there's a good chance OnTrac carried it the final mile.
The intrusion was spotted on 23 March. An internal investigation found the attacker was moving through files between 20 and 22 March. Three days inside a delivery network that touches tens of millions of households.
What was stolen?
Customer names, and other personal details that OnTrac has blanked out in the sample breach notice it filed with regulators. The company hasn't spelled out whether addresses, phone numbers or anything more sensitive were in the files.
Notification letters usually list the specific data categories exposed. A redacted sample suggests OnTrac is telling different customers different things, depending on what was in their record.
Did OnTrac pay a ransom?
Probably, though the company won't say so directly. OnTrac says it took steps to "ensure the data described above was re-secured and not distributed."
You can't re-secure data that has already left your network unless the people holding it agree to hand it back or delete it. That phrasing almost always describes a ransom payment: money paid in exchange for not publishing stolen files on a public leak site. OnTrac told BleepingComputer, which first reported the incident, that it's not aware of any fraud or publication of the stolen data. No ransomware or extortion crew has claimed the attack, which is consistent with a deal struck early.
It's a pattern we've reported before. Our July story on Kubota North America described intruders reading employee files quietly for weeks before the company acknowledged anything publicly.
What should OnTrac customers do?
Enrol in the free credit monitoring the company is offering, watch bank and card statements, and consider a fraud alert if anything looks off.
OnTrac is paying for 12 months of credit monitoring and identity protection through CyberScout. Customers have 90 days from receiving the letter to sign up. Don't leave it on the counter.
A fraud alert is free and tells lenders to double-check before opening credit in your name. A credit freeze goes further, blocking new credit applications entirely until you lift it. Both are worth considering if the letter suggests sensitive details beyond your name were in the files.
| Detail | What OnTrac says |
|---|---|
| Intrusion window | 20 to 22 March 2024 |
| Discovered | 23 March 2024 |
| Data confirmed exposed | Customer names, other details redacted |
| Customers affected | Not disclosed |
| Ransom | Not confirmed, wording suggests a payment |
| Support offered | 12 months CyberScout credit monitoring |
Who is likely behind it?
Unknown, and that silence is itself a clue. When ransomware groups don't get paid, they name victims on public leak sites within days or weeks to apply pressure. Months on from the OnTrac intrusion, nobody has claimed it. Either the attackers were unusually private, or they got what they wanted and moved on. The second possibility is the one that should concern every customer still waiting for their letter.
