Humana Inc. Data Breach Notice (Vermont Attorney General)

The filing from Humana Inc. to the Vermont Attorney General on July 23, 2026 lists Social Security numbers and health records as exposed for three people. If you received a letter from Humana about this incident, those two categories are now the ones that matter most in your situation.

Your Social Security Number Cannot Be Replaced

A Social Security number does not expire and cannot be reissued on request the way a credit card or password can. Once it leaves the organisation’s control it remains usable for identity theft, tax fraud, loan applications, and government benefit claims for the rest of your life. The three affected individuals now carry that permanent risk.

Health records add another lifelong exposure. Medical information can be used for insurance fraud, prescription scams, employment discrimination, or blackmail. Unlike a credit card number, a diagnosis or treatment history cannot be cancelled or reissued. The combination of an SSN and detailed health data creates a profile that is unusually valuable to criminals because it supports both financial fraud and medical identity theft at the same time.

What the Record Does Not Tell You

The Vermont filing does not disclose how the information was accessed, whether the cause was an external attack, a misconfiguration, or an insider, or how long the data may have been available. It also does not name any passwords, account credentials, or login details. No password rotation is required or useful for this incident.

Only three Vermont residents are named in the filing. The small number does not reduce the seriousness for those three people; each of them now faces the full weight of lifelong SSN and health-record exposure.

How to Determine Whether You Were Affected

Humana is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely you were not among the three people included. However, because the filing does not state when the incident occurred, anyone who has moved since their last interaction with Humana should contact the company directly to confirm their status. Absence of a letter is usually meaningful, but it is not absolute proof.

The Practical Consequences of These Two Categories

With your SSN exposed, new accounts can be opened in your name, tax refunds can be diverted, and medical services can be billed to your insurance. Health records increase the chance that someone can impersonate you at hospitals or clinics to obtain treatment, prescriptions, or even controlled substances.

These risks do not disappear after 30 or 90 days. The data retains value for years. Credit monitoring alone is not enough; active fraud alerts and periodic checks of your medical Explanation of Benefits statements become necessary ongoing habits.

Why the Small Scale Still Matters

Three people is a precise count, not an estimate. For each of those individuals the breach is total. The filing treats their records as a single incident, which means the SSN and health information were likely stored or accessed together. That linkage is what gives the exposure its power.

Because no passwords or authentication credentials appear in the listed categories, this is not an account takeover incident. It is a pure identity and medical privacy breach. The accounts themselves remain secure. The permanent identifiers tied to them do not.

Concrete Steps That Address This Specific Exposure

• Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion immediately. This stops new accounts from being opened in your name using the exposed SSN. A freeze is the stronger option and should be your default unless you expect to apply for new credit soon.
• Review every Explanation of Benefits statement from your health insurer. Look for services you did not receive. Medical identity theft often surfaces first as unexpected claims or bills. Report anything suspicious to your insurer right away.
• File your taxes as early as possible each year. An exposed SSN makes you a target for tax-refund fraud. Submitting your return before a fraudster does prevents diversion of any refund.
• Contact Humana directly to request a full copy of the incident letter and ask what exact records were involved for your file. Their notification to you will list the precise data elements that apply to you personally.
• Monitor your Medicare or private insurance accounts online regularly. Set up alerts for any change in address, phone number, or authorized contacts. Health-record fraud frequently begins with administrative changes that redirect correspondence.

The record is narrow but the consequences are permanent. The three affected individuals cannot change their Social Security numbers or erase their health histories. What they can control is how aggressively they monitor the downstream use of that information. The letter from Humana is the starting point; the actions above are the only practical response the filing supports.