McDermott Will & Schulte LLP Data Breach Notice (Vermont Attorney General)

The exposure of your Social Security number combined with health records creates a permanent risk that does not fade with time. With just 15 people named in this Vermont filing, the breach is small but the information involved is among the most sensitive that can be lost.

A Social Security Number Cannot Be Replaced

Unlike a credit card or password, a Social Security number stays with you for life. The filing from McDermott Will & Schulte LLP, dated August 28, 2026, lists Social Security numbers as exposed. Once that number is in the wrong hands it can be used to open accounts, file fraudulent tax returns, or claim government benefits in your name. These consequences can appear years later.

Health records add another layer. Medical information is intimate, valuable to fraudsters building synthetic identities, and protected under strict privacy rules precisely because it cannot be changed. The same filing lists health records among the data involved. Together these two categories give someone enough to impersonate you convincingly across financial, medical, and government systems.

What the Small Scale Actually Means

Only 15 Vermont residents are covered by this notification. That limited number does not reduce the harm to those affected. It does mean the organization knew exactly whose records were involved and was able to send targeted notices. The letter you receive will confirm which specific pieces of information were tied to your file.

The filing does not state when the incident occurred, only that the notification reached the Vermont Attorney General on August 28, 2026. Without an incident date, the letter itself becomes the clearest signal available. If you have not received one, it is likely you were not among the 15 people named. Anyone who has moved since receiving medical or legal services from the firm should contact McDermott Will & Schulte LLP directly to confirm their status.

Why These Two Categories Matter Long-Term

Social Security numbers and health records do not lose value the way passwords or credit card numbers do. A stolen SSN retains its power indefinitely because it cannot be reissued on request. Health records tie directly to your identity and medical history, making them useful for insurance fraud, prescription scams, or building a detailed profile for more sophisticated identity theft.

No passwords or login credentials appear in the exposed categories. That limitation removes one common avenue of immediate account takeover. The risk here centers on identity theft and medical fraud rather than someone logging into an online account at the firm.

The Gap Between Exposure and Notification

The record provides only the filing date of August 28, 2026. It does not disclose when the organization first learned of the incident or how long the information may have been accessible. State notification laws allow time for investigation, so the calendar gap alone does not prove delay. What matters is that the organization has now formally notified the state and, by law, must notify the individuals whose records were exposed.

How to Determine Whether This Affects You

The organization is required to notify affected individuals directly, usually by mail. Absence of a letter strongly suggests your records were not part of the 15 named in the filing. However, letters sent to outdated addresses can miss their target. If you have any relationship with McDermott Will & Schulte LLP as a client and have changed addresses in recent years, reach out to them to verify whether your information was included.

Protecting Yourself When SSNs and Health Data Are Loose

Because the exposed data cannot be changed, the focus shifts to monitoring and limiting what criminals can do with it. Place a freeze on your credit reports at the three major bureaus so new accounts cannot be opened without your explicit permission. This step is free, reversible, and one of the most effective controls available after an SSN exposure.

Review every Explanation of Benefits statement from your health insurer. Fraudsters sometimes use stolen health records to file false claims. Catching bogus charges early prevents them from affecting your coverage or creating medical debt in your name.

Monitor your tax filings closely in the coming year. Identity thieves often file early returns using stolen SSNs to claim refunds. If you receive a notice from the IRS that a return was already filed under your number, immediate action is required.

Consider placing an extended fraud alert on your credit file. It lasts longer than a standard alert and requires creditors to take extra steps to verify your identity before issuing new credit.

Finally, treat any unsolicited contact claiming to be from a medical provider, insurer, or government agency with caution. Verify requests for personal information through known, official channels rather than responding to incoming calls or emails.

The filing lists only Social Security numbers and health records. No other categories such as financial account numbers or driver’s license information are named. That narrow scope limits some risks but does not eliminate the lifelong exposure created by the two categories that are present.