National Corporate Housing Data Breach Notice (Massachusetts Attorney General)

A Social Security number exposed in a breach cannot be replaced. For the 17 Massachusetts residents named in National Corporate Housing’s filing, that permanence is the central fact. The Massachusetts Attorney General’s office received notice on August 07, 2026 that the company’s records containing Social Security numbers, driver’s license numbers, and credit or debit card numbers had been exposed.

What This Exposure Actually Enables

If your information was included, attackers now hold three of the most useful building blocks for identity theft. A Social Security number paired with a driver’s license number can be used to open new accounts, file fraudulent tax returns, or create synthetic identities. Credit or debit card numbers allow immediate fraudulent charges until the cards are canceled. Unlike passwords, none of these can be rotated or reset by you.

The filing does not state that any passwords were exposed. That absence is genuine good news. No one can use this incident to log into your National Corporate Housing account or attempt credential stuffing against other services you use.

The Records That Cannot Be Changed

Your Social Security number is now permanently sensitive. It will remain tied to your credit history, tax records, and government benefits for the rest of your life. The same number that verifies your identity with banks, employers, and the IRS can also be used by someone else to do the same. This is why the exposure of even a small number of records—17 in this case—matters long after the initial news cycle ends.

Driver’s license numbers add another layer of verifiable identity. Many financial institutions and government agencies accept a driver’s license or state ID as secondary proof when a Social Security number is already present. Credit and debit card numbers, while replaceable, create urgent short-term risk of direct financial loss.

How to Determine Whether You Were Affected

National Corporate Housing is required to notify affected Massachusetts residents directly, usually by mail. If you receive a letter from the company, that is the clearest confirmation that your records were included. Absence of a letter usually means you were not in the affected group. However, because the filing does not disclose when the incident occurred, anyone who has moved since then should contact National Corporate Housing directly to confirm whether their information was involved.

The Practical Risks That Remain

With a Social Security number and driver’s license number, criminals can attempt to:

• File a fraudulent tax return before you do and claim your refund
• Open new credit accounts or loans in your name
• Apply for government benefits using your identity
• Build a synthetic identity by combining your data with fabricated details

Credit or debit card numbers can be used for immediate online or in-person purchases. The filing does not indicate whether the data was merely accessed or actually exfiltrated, but the notification treats the information as exposed and therefore usable.

What You Can Still Control

While you cannot change your Social Security number, you retain significant control over how that number is used going forward. Monitoring and rapid response remain your strongest defenses. The categories exposed here are exactly those that credit bureaus, banks, and tax authorities already flag as high-risk when they appear in breach notifications.

Because this incident involves payment card data, existing cards can and should be canceled and reissued. New cards will carry new numbers, breaking the direct link to any fraudulent charges that might otherwise appear. Social Security numbers and driver’s license numbers require ongoing vigilance rather than one-time fixes.

Placing This Incident in Context

Seventeen people is a small number by breach standards, yet each record carries outsized risk precisely because the exposed categories are so valuable. The filing lists Social Security numbers, driver’s license numbers, and credit or debit card numbers. No other categories are named. The record contains no information about the root cause, whether the data left the company’s systems, or how long any exposure lasted. Those details remain undisclosed.

What the filing does establish is that these 17 Massachusetts residents now face elevated identity theft risk that will not expire. The letter they receive—or do not receive—is the only practical way for most people to know whether they are personally included.

Actions That Address This Specific Exposure

• Cancel and replace any credit or debit cards listed in your notification letter. New card numbers eliminate the immediate fraud risk from this breach.
• Place a fraud alert with the three major credit bureaus. This requires anyone opening new accounts in your name to verify your identity directly with you first.
• Monitor your credit reports weekly for the next year. Look for accounts, inquiries, or addresses you do not recognize. Free weekly reports are available from AnnualCreditReport.com.
• File your taxes early next year. Submitting your legitimate return before a fraudster can use your Social Security number is one of the most effective protections against tax-related identity theft.
• Contact National Corporate Housing directly if you have moved since the incident or have not received a letter but believe your records may have been involved. Only the company can confirm whether your specific information was exposed.

The exposure of these three categories creates real but manageable risk. Your Social Security number cannot be changed, but your response to its exposure can still limit the damage. Start with the replaceable items—new cards, fraud alerts, and close monitoring—then maintain vigilance on the permanent identifiers. The letter from National Corporate Housing remains the definitive answer to whether this filing applies to you.