YELLOW CORPORATION

Yellow Corporation reported a data breach to the Oregon Attorney General. The breach was reported on 2026-07-08. The breach occurred during 3/22/2025 - 3/27/2025. The breach was discovered on 3/27/2025. 258,498 individuals were affected. Notice was sent on 1/1/20016/26/2026.

Yellow Corporation and its affiliated debtors and debtors-in-possession under their jointly administered chapter 11 cases (Case No. 23-11069 (Bankr. D. Del. (CTG)) based in Overland Park, Kansas, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-11-12 and reported on 2026-06-30. 13,183 Texas residents were affected. 258,781 individuals affected in total. Types of information involved: Name of individual;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Health Insurance Information;Date of Birth. Consumers were notified via Notice by publication in print media;Posted at company website or special website.

Yellow Corporation identified suspicious activity and unauthorized access/exfiltration of files on its network on March 27, 2025. The incident affected historical data of former employees, including PII, government IDs, financial account numbers, and health information. Yellow engaged third-party specialists, contained the incident, and notified regulators and credit bureaus. Substitute notice was provided via website and media on June 26, 2026.

Yellow Corporation identified suspicious activity on its network on March 27, 2025, discovering that files were accessed and exfiltrated without permission on that date. The affected data may include names, SSNs, driver's license numbers, financial account numbers, and medical/health insurance information. The substantial majority of affected individuals are former employees. Yellow engaged third-party cybersecurity specialists, took systems offline, restored from backups, and implemented additional technical safeguards. No specific count of affected individuals was disclosed.

Yellow Corporation reported a data breach to the Indiana Attorney General. The breach occurred on 2025-03-27 and was reported on 2026-06-26. 6,191 Indiana residents were affected.

Yellow Corporation notified Nebraska regulators of a March 27, 2025 incident where unauthorized parties accessed and exfiltrated files containing PII, SSNs, financial, and health data. Yellow restored systems from backups, engaged third-party specialists, and provided substitute notice via media and website on June 26, 2026, offering one year of credit monitoring.

Yellow Corporation identified suspicious activity and unauthorized exfiltration of files on March 27, 2025. The incident involved former employee data including names, SSNs, financial account numbers, and medical information. Systems were restored from backups and additional safeguards implemented. No specific count of affected individuals was disclosed.

Yellow Corporation identified suspicious activity on its network on March 27, 2025, discovering that files were accessed and exfiltrated without permission on that same date. The affected data includes names, SSNs, driver's license numbers, financial account numbers, and medical/health insurance information. The substantial majority of the affected individuals are former employees. Yellow engaged third-party cybersecurity specialists, took systems offline, restored from backups, and implemented additional technical safeguards. No specific count of affected individuals was disclosed.

YELLOW CORPORATION AND ITS AFFILIATED DEBTORS AND DEBTORS-IN-POSSESSION UNDER THEIR JOINTLY ADMINISTERED CHAPTER 11 CASES (CASE NO. 23-11069 (BANKR. D. DEL. (CTG)) filed a data-breach notice with the Illinois Attorney General in June 2026 (case 26-06-1284). The register records the breach as discovered on November 12, 2025. Personal information types reported: drivers license, financial account number, medical information, passport number, ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.