Orrstown Bank Data Breach Notice (Vermont Attorney General)

The filing from Orrstown Bank, submitted to the Vermont Attorney General on June 12, 2026, states that the personal information of 11 people was exposed. The categories listed are Social Security Numbers, Government ID Numbers, Financial Account Codes, and Credit and Debit Account Info. No passwords were exposed.

Your Social Security Number cannot be replaced

If you are one of the 11 people named in this filing, your Social Security Number is now in the hands of unknown parties and cannot be changed like a password or a credit card. The same is true for any Government ID Numbers included. These identifiers stay with you for life, which is why they remain valuable for identity theft long after the initial breach.

The financial account codes and credit and debit account information listed can be used to attempt fraudulent transactions or to open new accounts in your name. While those specific accounts can usually be frozen or reissued, the presence of the Social Security Number alongside them creates a more durable risk. A thief who has both can more easily pass identity verification checks that many banks and lenders rely on.

What the 11-person filing actually tells you

This is a small breach by most standards, yet the categories involved matter far more than the headcount. A single Social Security Number paired with financial account details is enough for serious fraud. The record does not disclose how the information was accessed, whether the exposure was brief or extended, or the root cause. Those details remain unknown.

The Vermont filing does not list any other categories. No medical information, no dates of birth beyond what might be implied by an ID, and crucially, no passwords or login credentials. That absence is genuine good news. You do not need to change any Orrstown Bank password because of this incident.

How to tell whether this filing includes you

Orrstown Bank is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely that your information was not among the 11 records exposed. However, letters go to the last known address on file. Anyone who has moved since the incident should contact Orrstown Bank directly to confirm whether their records were involved.

The permanent risk and what actually lasts

Unlike a credit card number that can be canceled and replaced within days, a Social Security Number stays permanently valuable to identity thieves. The same applies to Government ID Numbers. Credit and debit account information can be monitored and frozen, but the combination of these elements means you must treat this exposure as long-term.

Thieves can use the stolen data to file fraudulent tax returns, open new loans, or impersonate you with government agencies. These crimes can take months or years to surface. Early detection is the only practical defense.

Concrete monitoring steps that address this exact exposure

Place a fraud alert or credit freeze with the three major credit bureaus immediately. A freeze is the stronger option if you do not plan to apply for new credit soon. It stops most lenders from opening accounts without your explicit permission.

Monitor your credit reports weekly for the next year. Look for accounts you did not open, unfamiliar addresses, or inquiries from lenders you have never contacted. The presence of your Social Security Number makes these checks essential rather than optional.

Review every explanation of benefits or account statement from banks and credit card issuers for unfamiliar activity. Even small test charges can signal that someone is probing the stolen financial account codes.

File your taxes early next year and respond immediately to any IRS notice about duplicate filings. Fraudulent tax returns are one of the most common consequences when Social Security Numbers are exposed.

Consider identity theft protection services that include dark web monitoring for your specific Social Security Number and Government ID Numbers. While no service can prevent all misuse, rapid alerts give you the best chance to limit damage.

The filing date of June 12, 2026 marks when Vermont received formal notice. The record itself does not state when the incident occurred, so the letter from Orrstown Bank remains your clearest indicator of whether you were affected. If you believe you may have been included but have not been contacted, reach out to the bank directly.