First Advantage 2025 Data Breach
The First Advantage 2025 data breach concerns a phishing compromise of one employee email account in the company's Drug & Occupational Health Screening Unit.
Exposed Data Types
4- Names
- Social security numbers
- Driver's license numbers
- Dates of birth
About This Breach
According to First Advantage's notice in the official Massachusetts archive, an unauthorized third party gained access on or about 13 November 2025 and downloaded the contents of the employee's email inbox. The company identified the incident on 17 November, disabled the account, and began an investigation.
Texas Attorney General record BR-0005194 publishes the same 13-17 November window and reports 40,596 affected people nationwide, including 3,608 Texas residents. The Texas figure is included in the national total and is not added to it.
What information may have been involved?
The Texas record lists names, Social Security numbers, driver's license numbers, and dates of birth as confirmed categories. The public Massachusetts sample letter redacts the recipient-specific field with a template placeholder, so it does not establish that every category applied to every person. The official sources reviewed do not connect this event to Profile Advantage consumer accounts or list email addresses or passwords as affected-person data; those earlier claims and categories have therefore been removed.
Organization response and safe next steps
First Advantage said it disabled the employee account, implemented additional safeguards across its systems, and was not aware at the notice date of fraud or misuse resulting from the incident. It offered affected people two years of credit monitoring and identity-restoration support; current eligibility and terms should be verified from the recipient's letter. People whose notice lists a Social Security or driver's license number can review credit reports for unfamiliar accounts or inquiries and consider a fraud alert or credit freeze. Unexpected messages claiming to represent First Advantage or a monitoring provider should be verified through a current official channel without using links in the message.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
