Impac Mortgage Holdings, Inc. Data Breach Notice (Vermont Attorney General)

The Social Security number belonging to one Vermont resident is now in the hands of an unknown party following a data breach at Impac Mortgage Holdings, Inc. A filing with the Vermont Attorney General on April 17, 2026 lists Social Security Numbers as exposed. No other categories of information appear in the record.

A Single Record, Yet Permanent Risk

Impac Mortgage Holdings, Inc. notified Vermont authorities that the personal information of one individual was involved. The filing does not disclose when the incident occurred, only that the company submitted this notice on April 17, 2026. Because the record names only Social Security Numbers, that is the sole category that can be discussed.

A Social Security number cannot be changed like a password or replaced like a credit card. Once it is exposed, it remains usable for identity theft, tax fraud, fraudulent loan applications, and account takeovers for years or decades. This is why regulators treat SSN exposures differently from almost every other type of breach.

What the Filing Does Not Contain

The Vermont record does not list passwords, financial account numbers, driver’s license numbers, dates of birth, or any other data. No passwords were exposed. This means there is no need to change any password connected to Impac Mortgage Holdings, Inc. as a direct result of this incident.

The filing also provides no information about how the data was accessed, whether it was exfiltrated, or the root cause. Those details remain undisclosed. What matters to the affected person is that their SSN is now outside the company’s control.

How to Determine If This Concerns You

Impac Mortgage Holdings, Inc. is required to notify affected individuals directly, usually by mail to the last known address. If you received such a letter, this filing refers to you. If you have not received a letter, it is likely your information was not included. However, anyone who has moved since the incident should contact the company directly to confirm their status, as mail can go astray or reach an outdated address. The filing does not state when the incident occurred, so the letter itself remains the only practical way to know.

Why Social Security Numbers Create Long-Term Exposure

Unlike credit cards that can be canceled or email addresses that can be changed, a Social Security number is a lifelong identifier. Criminals can use it to file fraudulent tax returns, open new accounts in your name, or claim government benefits. These crimes can go undetected for months or years because the number never expires and cannot be reissued on request.

Even a single exposed SSN paired with basic publicly available information can enable sophisticated identity theft. The fact that only one person is named in this Vermont filing does not reduce the seriousness for that individual. For them, the exposure is total and permanent.

The Practical Reality of Mortgage-Related Records

Impac Mortgage Holdings, Inc. is in the business of mortgages and lending. The presence of a Social Security number in their systems is expected. What is not expected is that it leaves their control. When it does, the affected person must assume it will circulate among fraud networks indefinitely.

This is not a temporary inconvenience. Monitoring must become part of your routine. Credit reports, tax transcripts, and new account alerts all become necessary tools because the SSN itself cannot be revoked.

Concrete Actions That Address This Exposure

• Place a fraud alert or credit freeze with the three major credit bureaus immediately. This prevents new accounts from being opened in your name using the exposed SSN. A freeze is the stronger option and can be lifted temporarily when you need to apply for credit.
• Monitor your credit reports weekly for the next year. Free weekly reports are available from AnnualCreditReport.com. Look for accounts you did not open or inquiries you do not recognize.
• File your taxes early each year and respond quickly to any IRS notices. Tax refund fraud is one of the most common crimes committed with stolen SSNs. Submitting your return before fraudsters do reduces that risk.
• Set up alerts with the IRS through their online account. This notifies you of any filings or activity tied to your SSN that you did not initiate.
• Contact Impac Mortgage Holdings, Inc. directly if you have moved or never received notification. Confirm whether your specific record was part of the incident. Ask what, if any, additional protections they are offering affected customers.

The exposure of even one person’s Social Security number matters because that number never loses its value to identity thieves. While the filing is limited in scope, its consequences for the individual named are lasting. The steps above cannot undo the breach, but they can limit what criminals are able to do with the information now that it is out of Impac’s hands.