Passwords are like keys to your house―they protect what’s most important to you, including your identity. Choosing a strong password―and remembering it―can be challenging, but it’s your first line of defense against cyber-attacks and identity theft. ADP issues SOC 1 Type 2 and SOC 2 Type 2 reports over select products and services.
Broadcom hit by employee data theft after breach in supply chain

In response, BSH engaged an incident response partner and third-party experts in order to conduct a forensic analysis as to the root cause of the incident. BSH did not directly engage or interact with the bad actor nor make or facilitate a ransom payment. Real-time data breach monitoring by scanning public databases, criminal forums, and online markets to detect exposed credentials and sensitive data. Due to the disorganized nature of the stolen data, it took considerable time for BSH and ADP to ascertain which employees were affected, and the specific details of the information compromised. The data exposed in the breach included tax information of employees of some ADP clients. The agency says the company did not have enough risk management controls in place before the incident took place.
- Customers of the global semiconductor giant Broadcom have had their sensitive data leaked on the dark web after a two-step supply chain attack.
- The second step is activating the account, and ADP sends activation codes to the companies that set up accounts with them.
- In late 2024, Business Systems House FZ-LLC (BSH) experienced a security incident that impacted clients’ data.
- For more specific help and instructions related to ADP’s data breach, please contact ADP Customer Service directly.
System vulnerabilities
It turns out that HR giant ADP, which provides payroll, tax and benefits administration for more than 640,000 companies, was vulnerable to an ID theft scam. The criminal hackers made off with tax and salary data, according to a report from Brian Krebs—although the actual number of employees affected has yet to be revealed. HR in any organization should be prepared to take action if employees are affected.

How was ADP hacked?
- ADP is a third-party service provider that offers payroll, tax and benefits administration to its vast clientele of over 640,000 companies around the world.
- This firm is a business partner of payroll company ADP which, in turn, worked with Broadcom.
- The El Dorado ransomware group claimed responsibility for the breach, which occurred as Broadcom was transitioning payroll providers.
- Due to the disorganized nature of the stolen data, it took considerable time for BSH and ADP to ascertain which employees were affected, and the specific details of the information compromised.
In response to this breach, Broadcom has urged its clients to enable multi-factor authentication (MFA) along with any additional security measures provided by their financial institutions. The company has also advised users to keep a close eye on their financial records for any irregularities. ADP’s Global Security Organization continues to actively monitor and respond to this developing situation as it does with all reported vulnerabilities. Clients are encouraged to visit ADP’s website at /trust to see Security Alerts to learn more about how ADP protects data, and how clients can help protect themselves. Upon receiving reports regarding these vulnerabilities, ADP’s Global Security Organization began an investigation to determine any potential impacts to our system. At this time, we can confirm that ADP does not currently utilize the MOVEit Transfer software, and no ADP systems or client data was impacted.
Broadcom no longer uses ADP or by extension BSH for payroll in the Middle East, the internal email confirmed, and at the time of the incident the company was in the process of switching payroll providers. For other enterprises, the incident serves as a potent reminder of the limitations of perimeter-based security and the need for a “trust but verify” approach—even when delegating critical HR and payroll processing to established third parties. Broadcom’s own documentation—unrelated to the breach but broadly relevant—has emphasized the importance of assuming compromise, regularly auditing vendor controls, and implementing rigorous incident response protocols. This situation serves as a clarion call for organizations to assess their cybersecurity measures, particularly those within interconnected supply chains, and emphasizes the importance of rigorous data protection protocols.
Both firms have reportedly engaged with law enforcement and data protection authorities and taken steps to “harden BSH’s environment to protect from similar attacks” going forward, according to statements published in The Register. The IRS found this out the hard way, and over the past year has removed two separate authentication systems that placed too much reliance on KBA and static data to authenticate taxpayers. In May 2015, the IRS took down its “Get Transcript” service after tax refund fraudsters began using it to pull W-2 data on more than 724,000 taxpayers.
Employer Payroll Taxes
Since 2020 and the rapid pivot of businesses to remote and hybrid working models, hackers have aggressively continued to exploit vulnerabilities and gaps in business security systems for malicious purpose. In the meantime, ADP says it has developed systems to monitor the Web for any other customers that may inadvertently publish their signup link and code. U.S. Bank spokesman Dana Ripley said the letter was sent to a “small population” of the bank’s more than 64,000 employees. ID thieves are interested in W-2 data because it contains much of the information needed to fraudulently request a large tax refund from the U.S. Bank shared a letter received from Jennie Carlson, the financial institution’s executive vice president of human resources. Broadcom serves a diverse range of customers across various industries, including technology, finance, healthcare, and telecommunications.
Products
In connection with providing payroll, tax and benefits administration, ADP stores tax and salary information, such as W-2s, for each of its customer’s employees. For some ADP customers, employees can view this information themselves by registering with ADP’s self-service portal. ADP has thus far not released information on how many records were put at risk by the successful hack against them, and security experts stress that ADP itself was not hacked. The breach was discovered after several customers reported fraudulent transactions made through ADP’s self-service portal. InstaCart, a grocery and home essentials delivery service, denies a data breach is the source of customer information being sold online on hacker forums. It says it believes the information was stolen from its platform using a “credential stuffing” attack.
The DOJ complaint also alleges Sullivan deceived the new management of the company about the incident after it hired a new CEO in 2017. Singapore’s Personal Data Protection Commission fines Grab, maker of a transportation, logistics, and financial services app, SG$10,000 ($7,325) for a series of data breaches compromising customer data. The breaches occurred after modifications made to its mobile app exposed to the risk of unauthorized access the information of 21,541 GrabHitch drivers and passengers. Shopify, an online commerce platform, reveals two rogue members of its support team compromised the data of less than 200 merchants doing business on the shopping site. Broadcom’s experience aligns with broader industry concerns over vendor risk management. The process of transitioning payroll providers, already complex given compliance and regional legal considerations, was further complicated by the lack of timely breach disclosure from BSH and ADP.
Broadcom itself was not alerted to the details until May 12, 2025—almost eight months after the initial intrusion. Broadcom serves some of the world’s largest companies across key industries such as technology, finance, and telecommunications—its clients include Apple, Samsung, Cisco, and British Airways, among others. While The Register notes that ADP itself has not been publicly tied to any direct data loss in this incident, its partner’s breach still raises questions about supply adp security breach chain cybersecurity risks. Broadcom responded to the breach by urging affected individuals to enable multi-factor authentication (MFA) on all financial accounts and to monitor financial activity closely. The company emphasized the need for elevated personal security precautions in light of the data exposed. We’re committed to keeping our products and services running smoothly so you can serve your employees.
Adp Clients Face Potential Tax Fraud After Recent Breach
Leaked data included federal taxpayer registry codes, social security numbers, bank account details, and salary information. If an organization had previously posted its unique ADP registration code publicly, the company should consider investigating whether any unusual or fraudulent activity took place with respect to ADP’s self-service portal. Payroll processing provider ADP has confirmed fraudsters gained access to some clients’ online portals and compromised the W-2 data of employees at more than a dozen customer firms. According to ADP, however, the theft occurred after the impacted companies mistakenly published unique access codes to employee accounts online.
The bank’s letter attributes the breach to a vulnerability in an external portal for W-2 information. The letter says that portal accounts created for individual employees, but that employees never used, were vulnerable to the ADP security breach. ADP is a third-party service provider that offers payroll, tax and benefits administration to its vast clientele of over 640,000 companies around the world. Back in November 2019, a car was broken into and payroll data from 29,000 current and former Facebook employees was stolen from a hard drive. Personal data including name, bank account details, and the last 4 digits of the employees’ social security number were taken. Much has been said in the recent past about the growing sophistication of hacking attacks, and this latest, sadly successful attack on ADP is a perfect example of that sophistication.
In general, the availability of SOC 1 and SOC 2 reports is restricted to customers who have signed nondisclosure agreements with ADP. Also, ADP currently produces four (4) bridge letters per year, each covering the calendar quarter, and covering a fiscal quarter at-a-time. Cloutier said ADP does offer an additional layer of authentication — a personal identification code (PIC) — basically another static code that can be assigned to each employee.
Bank, which contracts with ADP payroll services, sent a letter to its employees who may have been affected. The letter says the bank has been actively investigating the ADP security breach since April 19, 2016. According to news reports, cyber criminals appear to have gained unauthorized access to ADP, Inc.’s self-service customer portal to file fraudulent tax returns for some ADP customer employees. ADP has reportedly confirmed that a subset of its customers have been the victim of tax fraud perpetrated by hackers posing as customer employees on ADP’s portal.