Unverified claim: On September 24, 2026, ransomware group EndZone publicly listed U.S. workforce solutions firm eTeam Inc. (eteaminc.com) and claimed it had exfiltrated roughly 15,000 employee records — including Social Security numbers, dates of birth, home addresses, salaries, contracts, and manager identities. eTeam has not confirmed the intrusion, the record count, or the data types. Treat every field inventory below as actor marketing until the company or a regulator says otherwise. Canonical BreachHistory row: eteam-endzone2026. Primary monitor covering the listing: DeXpose’s EndZone/eTeam report.
What this is not is a company notice, an HHS OCR entry, or a Have I Been Pwned load. It is a leak-site / extortion announcement with a countdown-style threat: EndZone says it already tried private outreach, called eTeam “negligent,” and is offering “one more chance” before a dump. Extortion posts like that are designed to force a call, not to serve as audited forensic summaries.
What EndZone said about eTeam
According to the actor text mirrored by DeXpose, EndZone frames eTeam as a privately held global workforce solutions and business-transformation company founded in 1999, Minority Business Enterprise–certified, and managing thousands of internal employees and contract workers. The post cites revenue of about $229 million — again, that figure appears in the threat-actor blurb, not in an eTeam SEC filing tied to this incident.
The core claim is blunt: “We successfully exfiltrated all employee records (15K), including full names, email addresses, home addresses, DOBs, SSNs, phone numbers, contracts, managers, hire dates, salaries and more.” The group says private engagement failed and that it is going public as pressure. “Speak soon or leak soon” is the closer.
That inventory is serious if true. SSNs plus DOBs plus home addresses are classic identity-theft fuel. Salaries, hire dates, manager names, and contract language are leverage for payroll fraud, fake HR “benefits restore” phishing, and targeted social engineering against executives and contingent workers. None of it is company-confirmed in sources reviewed for this article.
What we know vs what we do not
Known from independent monitoring of the EndZone listing (not from eTeam):
- Victim named: eTeam Inc. / eteaminc.com, United States
- Actor named: EndZone
- Listing date observed: September 24, 2026
- Actor-stated count: ~15,000 employee records
- Actor-stated fields: names, emails, home addresses, DOBs, SSNs, phones, contracts, managers, hire dates, salaries, “and more”
- Actor narrative: prior private outreach ignored; public pressure phase underway
Not known from company attestation at indexing time:
- Whether any intrusion occurred
- Whether the archive is genuine, complete, or padded
- Initial access method (phishing, VPN, RDP, stolen SaaS token, insider, etc.)
- Whether encryption / ransomware payload ran alongside alleged theft
- Whether contractors, alumni, or client-placed workers are in the alleged set
- Whether regulators have been notified under state breach laws
Unverified ransomware listings routinely inflate headcounts, mix stale HR exports with fresh files, or recycle samples from earlier thefts. A 15k “all employee records” claim is specific enough to sound forensic. Specificity is not verification.
Why a staffing firm’s HR file is high-value
eTeam sits in workforce solutions — staffing, IT placement, and business transformation around contingent labor. That business model means HR systems often hold more than a single employer’s W-2 population. Depending on how eTeam structures its systems (and EndZone does not prove how), “employee records” in actor marketing can blur lines among corporate staff, recruiters, and contractors whose PII traveled through the same platform.
For attackers, staffing firms are attractive for three reasons. First, SSNs are abundant because payroll and I-9 workflows demand them. Second, the same databases often store bank details for direct deposit, emergency contacts, and resume-grade career histories that make spear-phishing sound legitimate. Third, the company sits in a trust chain: client companies receive placed workers whose background and tax data may have passed through the staffing vendor. Even when a claim remains unverified, the sector pattern is why HRIS theft keeps showing up on leak sites in 2026.
Compare adjacent unverified employee-database pitches catalogued the same week — for example EndZone’s other September listings against SaaS and telecom brands, or Emperador’s OnTrac employee-file claim. Different victims, same pressure play: name the HR crown jewels, threaten a dump, wait for a call.
Timeline as reported
Sometime before September 24, 2026 (actor claim only): EndZone says it contacted eTeam privately about an incident and received no meaningful engagement. There is no public timestamp, ticket number, or eTeam acknowledgment of that outreach.
September 24, 2026: EndZone posts eTeam on its public leak/extortion channel. Threat-intel monitors, including DeXpose, surface the listing the same day with the 15k employee-record claim and the SSN/salary field list.
Through indexing for this article: No eTeam customer/employee notice, status-page incident, or regulator filing confirming EndZone’s allegations had been located. BreachHistory therefore stores the row as companyConfirmed: false with an unverified actor count of 15,000.
If eTeam later publishes a notice — confirming, narrowing, or denying the claim — update the catalog row and treat this blog’s verification status as historical context from late September 2026.
Data types the actor listed
EndZone’s published inventory, paraphrased for clarity and still unverified:
- Full names
- Email addresses
- Home addresses
- Dates of birth
- Social Security numbers
- Phone numbers
- Employment contracts
- Manager identities
- Hire dates
- Salaries
- “And more” (undefined catch-all in the actor post)
What the actor did not clearly claim in the mirrored text: client customer databases, payment-card vaults, or proprietary source code. Absence from a leak-site pitch is not proof those systems were untouched. It only means EndZone chose to lead with HR identity data — the category most likely to scare executives and workers into believing a dump is imminent.
If you currently or formerly worked at eTeam (or placed through eTeam and wonder whether your contractor file lived in the same HRIS), do not assume you are “in” or “out” based on actor marketing alone. Wait for an official letter or portal notice that names data elements and a lookback window. Until then, the prudent personal response is the same playbook used after any credible SSN-exposure rumor: credit freeze readiness, tax-refund vigilance, and extreme skepticism toward payroll-themed phishing.
Who is at risk if the claim is even partly true
Current eTeam employees. SSNs, DOBs, and home addresses enable synthetic identity fraud and account takeovers that do not need your corporate password. Salary and manager fields help attackers forge “compensation review” or “benefits open enrollment” emails that look internal.
Former employees and contractors. HR archives often retain terminated and contingent records for years. A dump labeled “employees” can still include people who left in 2023. Do not skip credit monitoring because your badge was deactivated.
Managers and executives named in org charts. Manager fields are targeting lists. Expect deepfake voice or text messages that cite a real hire date or salary band to authorize wire changes or gift-card “emergency” purchases.
Client companies that use eTeam staffing. Even if EndZone’s archive is only eTeam corporate HR, clients may see secondary phishing that pretends to be eTeam recruiters requesting updated banking for “placement payroll.” Verify out-of-band using known client-service contacts, not reply-to addresses in scary emails.
People who never worked at eTeam. Leak-site drama often spills into brand impersonation. “eTeam data breach claim portal — submit SSN to check exposure” sites are a predictable follow-on scam. There is no legitimate reason to paste your SSN into an unsolicited “breach checker” that appeared the week of a ransomware listing.
EndZone campaign context in September 2026
EndZone’s eTeam post is not an isolated brand name on an otherwise quiet board. The same period saw EndZone listings against other U.S. technology and services companies — including unverified claims involving Accela and Momentum Telecom already covered on BreachHistory. Pattern recognition matters: multi-victim weeks often mean one intrusion pipeline (stolen RDP, purchased VPN creds, or a shared vulnerability) being monetized across several targets, or simply a busy week of leak-site theater. Without company confirmations, you cannot tell which.
Staffing and professional-services firms have been recurring ransomware targets because downtime hits billable placement pipelines and because HR data is dense with government identifiers. That industry pressure does not prove eTeam was hit. It explains why EndZone’s pitch lands with readers who already follow staffing-sector incidents.
For related reading on other unverified EndZone pitches and on verified SSN exposures that do carry regulator notices, see BreachHistory’s fixed “you may like” links at the end of this page — including Accela and Momentum Telecom EndZone claims, plus confirmed SSN notices such as Tessco and Rockwood Retirement.
What eTeam and regulators have said
As of the September 25, 2026 indexing window for this article: nothing confirming EndZone’s allegations from eTeam’s public channels was located. No mirrored employee letter, no California/Maine AG sample notice tied to this EndZone claim, and no HHS OCR entry (eTeam is not a covered healthcare entity in the usual OCR sense anyway). Silence is common in the first days after a leak-site post. Silence is also what you see when a claim is fabricated or exaggerated.
Workers should watch for:
- An email or mailed letter from a known eTeam HR domain describing an investigation
- A state attorney general breach notice naming eTeam and listing data elements
- A credit-monitoring enrollment code from a named vendor (Experian, Equifax, Kroll, etc.) that matches a letter you already received — never the other way around
Do not treat DeXpose, RansomLook mirrors, or Telegram screenshots as stand-ins for that notice. They are useful for early warning. They are not legal notification.
Phishing and fraud patterns to expect now
Whether or not EndZone holds a real archive, the public claim alone is enough for opportunists to run social-engineering campaigns. Concrete examples tied to this story:
“eTeam HR — confirm your SSN after the EndZone leak.” Fake Microsoft Forms or DocuSign lookalikes asking you to “verify” the last four of your SSN plus bank routing so “payroll can be protected.” Real HR will not ask you to re-enter a full SSN in a cold email.
“IT Security — reset VPN before ransomware encryption.” Urgency plus ransomware news is a classic MFA-fatigue or credential-harvest combo. Use the company helpdesk number you already know, not the number in the email signature.
“Manager escalation — wire approval for incident counsel.” If EndZone’s manager and salary fields are real, attackers can name your boss and cite a plausible compensation figure. Call the manager on a known internal line.
“Credit freeze help desk — we noticed eTeam SSN exposure.” Impersonators offer to “place the freeze for you” if you read a one-time passcode. Freezes are placed only through the bureau sites or apps you navigate to yourself.
Client-facing recruiter spoofs. “Updated contractor ACH for next week’s eTeam placement” messages aimed at client AP teams. Clients should verify via the staffing relationship manager already on file.
What you should do
- Wait for an official eTeam notice before assuming confirmed exposure — but prepare as if SSNs might be in play if you are a current or recent worker.
- Place a credit freeze with Equifax, Experian, and TransUnion if you want maximum friction against new-account fraud. Unfreeze briefly only when you initiate credit.
- Enable IRS Identity Protection PIN (IP PIN) so a tax refund cannot be filed in your name as easily after SSN theft.
- Treat payroll, benefits, and W-2 “correction” emails as hostile until verified out-of-band. Especially anything referencing EndZone, “leak soon,” or a public claim portal.
- Rotate passwords for any personal accounts that reused an eTeam-related password or email recovery path; turn on MFA everywhere it exists.
- Monitor bank and brokerage accounts for unexpected micro-deposits or ACH changes that often precede larger fraud.
- If you are a client security team, brief AP and hiring managers on eTeam-themed ACH-change and resume-phishing lures for the next several weeks.
- Document everything — screenshots of suspicious mail, dates you contacted HR, and any enrollment codes from legitimate monitoring offers — in case a confirmed notice arrives later.
- Do not pay, negotiate, or reply to anyone claiming to represent EndZone. That includes “brokers” offering to delete your row from a dump.
- Check BreachHistory’s canonical record at /eteam/eteam-endzone2026 for status updates if eTeam or regulators later confirm or retract the claim.
Operational notes for HR and security teams
If you work inside eTeam’s security or people-operations org and this listing is news to you, the first hours are about containment and truth-finding — not arguing with a leak site. Pull identity-provider and HRIS access logs for anomalous bulk exports, privileged API keys, and new OAuth grants to payroll or benefits apps. Check VPN and remote-access concentrators for impossible travel and shared accounts. Preserve disk images and cloud audit trails before “cleaning” anything that might later become forensic evidence.
Coordinate legal early on notification triggers. U.S. state breach laws generally clock from discovery of personal information acquisition, not from the day a ransomware gang posts a press-style threat. A public EndZone claim can still be a useful external tip that starts the discovery clock — or it can be noise. Counsel decides which, based on internal evidence. Do not let marketing rewrite an unverified claim into a confirmed breach on social media before forensics finish.
For worker communications, draft two tracks in parallel: (1) a holding statement if journalists call (“We are aware of an unverified claim; we are investigating; we will notify affected individuals if required”), and (2) a full notice template ready if forensics confirm SSN-class data left the environment. Confusing those tracks is how speculative posts become permanent reputational damage.
Client account managers should get a short internal FAQ: what EndZone claimed, what eTeam has or has not confirmed, and how clients should route phishing reports that mention eTeam placements. Contingent-labor clients will ask whether their worker SSNs sat in eTeam systems. Answer only what you can support with data-flow maps — inventing reassurance is worse than saying the investigation is open.
Identity theft follow-through if a notice arrives
If eTeam later confirms SSN exposure and offers credit monitoring, enroll — but treat monitoring as a detection layer, not a freeze substitute. Freezes stop most new-account openings; monitoring tells you after something already happened. File an FTC IdentityTheft.gov report if you see concrete misuse. Place a fraud alert if you prefer a lighter-weight step than a full freeze. Watch Social Security Administration mySSA for unexpected earnings, and check healthcare insurers for policies opened in your name using your SSN and DOB pair.
Salary and contract leakage creates a quieter harm: compensation leverage and blackmail. Managers should brief teams that discussing alleged leaked pay bands in Slack or LinkedIn only helps attackers validate the dump. If someone contacts you claiming they “found your salary in the EndZone file” and wants money for silence, that is extortion — document and report; do not pay.
How this should be cited
Accurate short form: “In September 2026, EndZone claimed it stole about 15,000 eTeam employee records including SSNs and salaries; eTeam had not confirmed the claim at the time of reporting.” Inaccurate short form: “eTeam was breached and 15,000 Social Security numbers leaked.” The second sentence converts an extortion listing into a verified fact. Do not do that.
Journalists and SOC teams should separately track (1) the leak-site claim, (2) any later company confirmation, and (3) any unrelated eTeam incidents. Collapsing those threads is how unverified actor counts become permanent “facts” in secondary coverage.
Canonical record and sources
BreachHistory catalog entry for this unverified claim: https://breachhistory.com/eteam/eteam-endzone2026. The row stores recordsAffected as 15000 with companyConfirmed: false, labels the title and root cause as an EndZone leak-site claim, and cites DeXpose’s September 24, 2026 write-up of the actor statement.
Primary external source used for actor text and listing date: EndZone Ransomware Strikes eTeam Inc. (DeXpose). Secondary mirrors of the same EndZone marketing language circulated the same day on other ransomware trackers; they do not add independent confirmation.
If you held an eTeam badge, contractor agreement, or placement file and want a practical next step today: freeze credit if you have not already, ignore any “verify SSN for the EndZone incident” form, and watch for a letter that comes from eTeam — not from the group claiming to own the data.