Herbert Smith Freehills Kramer (US)  LLP Data Breach Notice (Vermont Attorney General)

The filing from Herbert Smith Freehills Kramer (US) LLP, submitted to the Vermont Attorney General on July 29, 2026, states that information belonging to four people was exposed. Among the categories listed are Social Security Numbers, Government ID Numbers, and Health Records.

Four people. Three categories that cannot be replaced.

When a record containing your Social Security number leaves authorised control, it does not expire. The same number will be tied to your name, credit history, tax filings, and benefits for the rest of your life. Government ID numbers function in the same permanent way. Health Records add a second permanent risk: they can be used for insurance fraud, prescription forgery, or blackmail long after the incident itself is forgotten.

The record does not list passwords, account credentials, or any other information that can be changed quickly. That absence is meaningful. No immediate password reset is required for this incident. The exposure centres on data that stays valuable to identity thieves and fraudsters for decades.

What a Social Security Number and Government ID actually enable

With a name, Social Security number, and a government ID, it is possible to open new financial accounts, file fraudulent tax returns, claim government benefits, or apply for credit in your name. These documents are the foundational pieces used to build synthetic identities or to take over existing ones.

Health Records increase the stakes. Medical identity theft is harder to detect than financial fraud because victims rarely review Explanation of Benefits statements line by line. A stolen health record can lead to bills appearing on your insurance, incorrect information added to your permanent medical file, or prescription abuse under your name.

The filing lists these three categories for the incident. It does not mean every one of the four individuals had all three types of data exposed; your own notification letter will specify what applied to you.

The only reliable way to know if you are one of the four

The organisation is required to notify affected individuals directly, usually by post. If you receive a letter from Herbert Smith Freehills Kramer (US) LLP, treat the contents as authoritative. Absence of a letter usually means your records were not included in this filing. However, if you have moved since the time the incident occurred, the letter may have gone to an old address. In that case, contact the firm directly to confirm whether your information was involved.

The filing does not state when the incident occurred, only the date it reached the Vermont Attorney General. This means the letter itself remains the single practical test available to you.

Why these four records matter more than the small headcount suggests

Four affected individuals is an unusually low number for a law firm breach notice. The small scale does not reduce the severity for those four people. Each record contains lifelong identifiers. For the individuals named, the practical impact is identical to any other breach involving Social Security numbers and health data.

Because the exposed categories retain their value indefinitely, the standard advice about “monitoring for a few months” does not fully apply. Identity thieves can wait years before using stolen Social Security numbers. Health Records can surface in unexpected places long after the initial exposure.

The permanent nature of the risk

A Social Security number cannot be reissued on request the way a compromised credit card can. Once it is known to unauthorised parties, the best available protection is vigilance, not replacement. The same holds for government ID numbers listed in the filing.

Health Records cannot be changed either. You cannot reset your medical history. The exposure therefore creates a lifelong need for careful monitoring of both financial and medical paperwork.

Concrete differences this exposure creates for the people affected

Anyone whose records were included now faces an elevated risk of tax fraud, medical identity theft, and long-term credit abuse. These risks do not disappear after a year or two. Credit monitoring services that focus only on new accounts may miss medical fraud or tax-related identity theft.

The absence of exposed passwords or login credentials in the filing is genuine good news. It means this incident does not require you to treat the law firm’s systems as compromised for future logins. The account-level risk that exists in many other breaches is not present here.

Placing the incident in context without speculation

The record contains only what the law firm disclosed: the categories involved, the number of Vermont residents affected, and the filing date. It does not describe how the data was accessed, whether a vendor was involved, or any other detail about root cause. Those facts remain unknown to the public.

What is known is narrow but serious: four people had their Social Security Numbers, Government ID Numbers, and Health Records listed in this notification. Those three categories are among the most durable and damaging when exposed.

The letter you may or may not receive is the only document that can tell you with certainty whether you are one of those four. Read it carefully when it arrives. If you have any doubt because of a recent move, reach out to the firm. For everyone else, this filing serves as a reminder that even organisations that handle sensitive client data can lose control of the exact information that identity thieves value most.