FAT Brands, Inc. Data Breach Notice (Vermont Attorney General)

A data breach affecting just 7 people has exposed some of the most sensitive information a company can hold: Social Security numbers, government ID numbers, financial account codes, credit and debit account information, and health records.

Because these records belong to patients whose data FAT Brands, Inc. held, the exposure creates lifelong risks that cannot be undone by a simple password change or card replacement. The filing, submitted to the Vermont Attorney General on November 11, 2026, confirms these exact categories were involved. No passwords were exposed.

A Social Security Number Cannot Be Replaced

Once a Social Security number is loose, it remains usable for identity theft, tax fraud, and loan applications for decades. The same permanence applies to government ID numbers. Health records add another permanent vector: they can be used to file false medical claims or to impersonate you when seeking care.

Credit and debit account details can usually be canceled and reissued, but when combined with SSNs or government IDs they make it far easier for fraudsters to open new accounts in your name. The small number of people affected — exactly 7 — does not reduce the severity for those who were included.

What the Filing Does Not Tell Us

The record does not disclose when the incident occurred, how it happened, or whether the data was taken by an outsider, an insider, or a third party. It also does not state whether every person lost every type of record listed. Only the organization’s direct notification can tell an individual which specific pieces of their information were exposed.

FAT Brands, Inc. is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your information was not included. However, anyone who has moved since the incident should contact the company directly to confirm their status.

Why Health Records and Government IDs Matter Long-Term

Health records tied to an SSN create a complete profile that identity thieves prize. Medical identity theft can lead to incorrect information in your permanent health file, denied claims, or surprise bills. Government ID numbers paired with financial account codes lower the bar for convincing banks, insurers, or government agencies that the thief is you.

These risks do not fade after 30 or 90 days. The value of this combination of data is measured in years, not months.

Practical Steps That Address This Exposure

• Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion immediately. This is the single most effective way to stop new accounts from being opened using your SSN.
• Review every Explanation of Benefits from your health insurer. Look for claims you did not make and dispute them at once.
• Monitor existing financial accounts daily for the next several weeks, then switch to weekly reviews. Set up transaction alerts for any card still active.
• File your taxes early next year and watch for IRS rejection notices that could signal someone else has used your SSN.
• Contact FAT Brands, Inc. directly if you believe you should have received notification but have not, especially if you have changed address in recent years.

The letter from the company remains the only definitive way to know whether you are one of the seven people affected. Treat any letter you receive as containing your exact list of exposed data and follow the remediation steps it provides.