Directed Trust Data Breach Notice (Indiana Attorney General)

The breach notification from Directed Trust means that personal information belonging to 104 Indiana residents was exposed on July 04, 2026. The organisation filed the notice with the Indiana Attorney General on October 27, 2026 — an interval of 115 days.

Personal Information That Cannot Be Replaced

The filing lists personal information as exposed but does not name any permanent identifiers such as Social Security numbers, driver’s license numbers, or passport numbers. No passwords or credentials appear in the exposed categories.

This is genuinely good news. Because no government-issued identifiers were listed, the long-term risk of new account fraud or tax-related identity theft is lower than in many similar incidents. The exposed personal information still carries risks of impersonation or targeted fraud attempts that do not fade with time, but the absence of the most dangerous fields limits what attackers can do without additional information from elsewhere.

What the 115-Day Gap Means for You

The incident occurred on July 04, 2026 and the filing arrived more than three and a half months later. Notification timelines vary by state law and the length of any internal investigation, so the gap alone does not prove fault. It does, however, mean that anyone whose records were included went at least 115 days without knowing their information had been exposed.

How to Tell If This Breach Affects You

Directed Trust is required to notify affected customers directly, usually by mail to their last known address. If you have not received a letter, your information was likely not included. Anyone who has moved since July 04, 2026 should contact Directed Trust directly to confirm whether their records were part of this incident.

The Risks That Remain

Even without permanent identifiers, exposed personal information can be combined with data from other sources to impersonate you in customer service calls, support phishing attempts, or enable more convincing social engineering. These risks do not expire. The fact that only 104 people were affected suggests a narrowly scoped incident rather than a mass exposure, but the records involved still belong to real customers whose details are now outside the organisation’s control.

Concrete Actions That Address This Exposure

• Monitor your accounts and statements closely for the next 12 months. Look for unfamiliar transactions or changes even if no financial data was listed in the filing.
• Place a fraud alert with one of the three major credit bureaus. This forces lenders to verify your identity before opening new accounts and lasts 90 days (you can renew it).
• Review your annual credit reports at AnnualCreditReport.com. Check for accounts or inquiries you do not recognise; the exposure of personal information makes it easier for fraudsters to attempt synthetic identity applications.
• Be extremely cautious with unsolicited calls or emails claiming to be from Directed Trust. Use only contact details you verify yourself, as personal details make phishing more effective.
• If you receive the notification letter, follow its specific instructions immediately. The letter will confirm exactly which information applied to you.