OnTrac, a private parcel delivery company that handles last-mile package deliveries across 35 US states — covering roughly 70% of the American population — has begun notifying customers that hackers broke into its corporate network and accessed customer files. The breach occurred over three days from March 20 to 22, 2026, and was discovered the following day. OnTrac has confirmed that customer names were among the exposed data, but the full list of compromised information remains unclear; the company redacted other data elements from notifications sent to state authorities.
OnTrac operates through more than 102 delivery locations and works with over 7,000 independent contractors. If you’ve received packages from online retailers using OnTrac for delivery — particularly in the western and southeastern United States where the company is most active — your information may have been included in the breach. No ransomware group has claimed responsibility for the attack.
How to check if you’re affected
Affected products include OnTrac parcel delivery service accounts used before March 2026 across its 35-state service area. OnTrac is mailing breach notification letters to impacted customers and offering 12 months of free credit monitoring and identity protection through CyberScout — watch your mail for this letter and enrol within the 90-day deadline. You can also check your credit reports proactively at annualcreditreport.com and place a fraud alert with the major credit bureaus if you’re concerned.