Singleton Schreiber, LLP Data Breach Notice (Massachusetts Attorney General)

A single person’s records were included in this filing. That makes the exposure both unusually small and unusually personal: one individual’s Social Security number and medical records are now listed in an official Massachusetts breach notice filed by Singleton Schreiber, LLP on June 01, 2026.

Your Social Security Number Cannot Be Replaced

The filing names Social Security numbers as one of the two categories exposed. Unlike a password or credit card, a Social Security number is permanent. It cannot be reissued on request the way a compromised account credential can. Once it is out of the organisation’s control, it remains a lifelong key that can be used to open accounts, file fraudulent tax returns, or claim government benefits in your name.

Medical records appear alongside it in the same notice. These documents often contain diagnoses, treatment histories, and other protected health information that, when combined with a Social Security number, can make identity theft both more convincing and harder to unwind. A fraudster who possesses both can more easily impersonate you to insurers, pharmacies, or government agencies.

What the Record Does and Does Not Tell Us

The Massachusetts Attorney General’s filing establishes that one person was affected and that the exposed categories include Social Security numbers and medical records. It does not disclose the root cause, whether the information was copied or simply viewed, or any details about how the incident occurred. Those facts remain outside the public record.

No passwords or login credentials were listed in the exposed categories. That absence is meaningful: there is no need to change any password specifically for this incident, and the account itself is not at direct risk of takeover through stolen login details.

How to Determine Whether This Notice Applies to You

Singleton Schreiber, LLP is required to notify affected individuals directly, usually by mail. If you received a letter from the firm, this filing concerns you. Absence of a letter usually means your records were not part of the group named in this notice. Because the filing does not state when the incident occurred, there is no reliable “move date” test available. The letter remains the only practical way to confirm inclusion.

The Lifelong Nature of These Two Data Types

Most breach coverage focuses on credit cards because they can be canceled. The categories here cannot. A Social Security number stays with you for life. Medical records tied to that number create a permanent profile that can be used for medical identity theft—filing false claims, obtaining prescriptions, or altering your health history in insurance databases. These risks do not expire when the news cycle moves on.

At the same time, the extremely limited scope—one person—means this is not a mass exposure that will likely appear in broad dark-web dumps. The record supports treating it as a targeted or narrowly contained event rather than a bulk data sale.

What Remains Under Your Control

While you cannot change your Social Security number, you can reduce what an attacker can do with it. Placing a freeze on your credit files at the three major bureaus prevents new accounts from being opened without your explicit permission. Monitoring your Explanation of Benefits statements from every health insurer you use lets you catch fraudulent claims quickly. Tax transcript monitoring through the IRS can flag fraudulent filings before they trigger unexpected bills or audits.

These steps do not undo the exposure, but they limit the practical damage that can be done with the specific categories named in the filing.

The Value of Medical Records in Identity Crimes

Medical data is prized because it is difficult to verify from the outside. A fraudster who knows your diagnoses or treatment history can more credibly pose as you when speaking to insurers or providers. When that information is paired with a Social Security number, the combination becomes powerful enough to support long-term fraudulent activity rather than one-off theft.

The filing does not indicate that the data was definitely exfiltrated, only that it was exposed in the incident. In either case, the prudent assumption for the affected individual is that the information is now outside the firm’s direct control.

Why the Scale Matters Here

One affected person is the smallest number these filings report. It removes the “I’m just one among millions” dilution that often accompanies larger breaches. For the individual named, the exposure is total and personal. The organisation has a direct obligation to that single person to provide clear guidance and, where required by law, credit monitoring or identity protection services.

Because the record names only Social Security numbers and medical records, other common categories such as financial account numbers or driver’s license numbers are not listed. That absence is genuine information: those items were not part of this particular filing.

The notice reaches the public through the standard Massachusetts Attorney General breach reporting process. It does not reflect any determination of fault, only the legal requirement to disclose when certain categories of personal information are involved.

Concrete Protections Worth Taking First

• Freeze your credit reports at Equifax, Experian, and TransUnion. This is the single most effective step against new-account fraud using a stolen Social Security number.
• Review every Explanation of Benefits from your health insurers. Look for claims you did not file or services you did not receive.
• Set up IRS online account access and request tax transcripts regularly to detect fraudulent filings made with your Social Security number.
• Place a fraud alert with the three credit bureaus if you prefer not to freeze your files; it requires creditors to verify your identity before opening new accounts.
• Contact Singleton Schreiber, LLP directly if you believe you should have received a letter but have not. Ask what specific protections they are offering the individual named in the filing.

The exposure is real and the identifiers are permanent, but the scope is narrow. Acting quickly on the categories that matter most—credit freezes, medical claim monitoring, and tax oversight—gives you the practical control still available after this type of breach.