AccidentalProfessional ServicesProfessional ServicesMisdeliveryEmployee Data InvolvedEmploymentFinancial accountIdentity (basic)Government IDMediumContained

Cross Recruiting Inc.

bd_ecd1bdb3c58e823b · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 19, 2026

Filed

Jun 26, 2026

To disclose

5 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Cross Recruiting Inc. →

Cross Recruiting Inc., dba Cross Resource Group disclosed a cybersecurity incident on May 19, 2026, involving the inadvertent disclosure of employee personal information (names, addresses, SSNs, payroll data) to an unauthorized recipient. The company engaged cybersecurity experts, contained the incident, and is offering 24 months of complimentary credit monitoring to affected current and former employees.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 38 days

May 19, 2026

Discovered

Jun 26, 2026

Filed

vs. sector median

13 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_deb791378d78c1c12026-06-29 · +3dVerified
Indiana State AGbd_95beb1b9a524f9d42026-06-18 · +8dVerified

Name: Cross Recruiting Inc.
norm: cross recruiting

Name: Cross Recruiting Inc.
norm: cross recruiting
Also named: Cross Recruiting Inc.dba oflegal entity
Cross Resource Groupdba oftrade name
Industry: Professional Servicesllm

Discovered: May 19, 2026
Materiality determined: —
Notification sent: Jun 18, 2026
Affected individuals: 3state-resident count only
Data types: EmploymentFinancial accountIdentity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1566.002 Spearphishing Link

During the incident: Engaged cyber security experts to launch an investigation
IT Department quickly identified the threat
Took action to request deletion or destruction of the information
Confirmed that it had not been further shared or used
Changes made: Security measures were implemented to contain the Incident and mitigate any potential impact
Working with its IT team and cyber security partner to constantly evaluate security protocols and processes to prevent future incidents
Offering complimentary access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 18 · first

Massachusetts State AG+8d · this page

New Hampshire State AG+11d

Pattern: first filing Jun 18 (IN), last Jun 29 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1041-cross-recruiting-inc-dba-cross-resource-group/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2026
Raw hash: 1b08c362e5aeca6015716d2b788cb6de911b9d6c1353fa0185eda43154b475cb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCross Recruiting Inc.

Victim entityCross Recruiting Inc.

Incidentdiscovered May 19, 2026

Stated responseEngaged cyber security experts to launch an investigation

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov