Kelly Benefits 2024 Data Breach

According to the company notice sample, suspicious activity prompted an investigation with third-party forensic specialists. The review established the December 12-17 access window, and notices were sent in stages after affected files were matched to people and client organizations. The publicly available sources do not disclose the initial access method or identify the responsible actor.

The reported count changed over time. An archived April 21 version of the Maine Attorney General record shows 263,893 people, while independent healthcare-security reporting later relayed revisions to 413,032 and finally 553,660. These are not separate events or additive subsets; 553,660 is the latest external people total. It is not a local row, account, or searchable-email count.

The structured classes jointly supported by the current source set are names, dates of birth, Social Security numbers, health-insurance information, financial-account information, and medical information. The notice states that the affected elements vary by person, so the six fields should not be assumed to occur together for everyone.

Passwords, usernames, email addresses, full payment-card numbers, and tax identification numbers are not retained as verified structured classes for the general event in the selected reliable sources. The earlier umbrella label “protected health information” has also been removed because it repeated the more specific health categories. A person's exact field scope can be established only from their own notification letter.

Production has no import job associated with the Kelly Benefits identity. The email, username, password, identity, phone, IP, personal-field, sensitive-data, and general breach-data collections all contain zero local links. The externally reported 553,660 people are therefore not presented as locally searchable records, and local co-occurrence of the reported fields is not claimed.

The current Kelly Benefits domain is operational and verifies the organization's benefits-administration, insurance-consulting, and payroll-service identity; its bot protection can return HTTP 418 to automated direct requests. People who received an incident notice should act according to the fields named in their own letter and verify unexpected payment, benefits, or identity requests through a separately obtained official channel rather than a link in the message.