SOC, a Day & Zimmermann Data Breach Notice (Massachusetts Attorney General)

A Social Security number and medical records belonging to one Massachusetts resident are now in unknown hands following a data breach disclosed by SOC, a Day & Zimmermann company. The filing, submitted to the Massachusetts Office of Consumer Affairs on July 17, 2026, lists these two categories as exposed. No other details about the cause or method are provided.

What This Exposure Actually Means

If you received a notification from SOC, a Day & Zimmermann company, your Social Security number can no longer be considered private. Unlike a credit card or password, a Social Security number cannot be changed or reissued on request. It remains a permanent identifier that identity thieves can use for years to open accounts, file fraudulent tax returns, or claim government benefits in your name.

The inclusion of medical records adds another lasting risk. These documents often contain diagnoses, treatment histories, and other sensitive health information that can be exploited for insurance fraud, prescription scams, or blackmail. Medical identity theft is particularly difficult to detect because victims may not learn of it until they receive an unexpected bill or a denial of coverage years later.

The record states that exactly one person was affected. This is not a mass breach affecting thousands; it is a highly targeted exposure of one individual’s most sensitive identifiers. That narrow scope does not reduce the severity for the person involved. It simply means the letter you received almost certainly applies to you if it arrived.

Social Security Numbers Have Lifelong Value

Because a Social Security number cannot be rotated like a password or canceled like a credit card, the exposure creates permanent risk. Thieves do not need to use the number immediately. They can hold it for months or years until an opportunity arises. This is why the filing’s confirmation that Social Security numbers were exposed matters far more than many other types of data.

No passwords were exposed in this incident. That is genuinely good news. You do not need to change any password connected to SOC or Day & Zimmermann. The breach does not put your online accounts at direct risk of credential-based takeover.

Medical Records Cannot Be Reset

Medical records are also permanent. Once they leave the organisation’s control they cannot be recalled. The combination of a Social Security number and medical records is particularly valuable to criminals because it allows them to build a convincing profile for both financial fraud and medical identity theft.

The filing does not state when the incident occurred, only that the notification was filed on July 17, 2026. Without an incident date, it is not possible to apply any “have you moved since” test. The letter itself remains the only reliable indicator of whether your information was included.

How to Determine If You Are Affected

The organisation is required to notify affected individuals directly, usually by mail. If you have not received a letter from SOC, a Day & Zimmermann company, your information was most likely not part of this filing. However, letters can go to outdated addresses. Anyone who has changed residence since receiving care or billing from this organisation should contact them directly to confirm their status.

The Limits of What the Filing Tells Us

This notification establishes only that one person’s Social Security number and medical records were exposed. It does not disclose the root cause, whether the data was taken by an outsider or an insider, or any details about how the information was stored. Those facts remain unknown to the public.

What is known is narrow but serious: one Massachusetts resident’s permanent identifiers are now outside the organisation’s control. The lifelong nature of both a Social Security number and medical records means the consequences of this breach cannot be fully resolved by simple steps such as freezing credit.

Concrete Steps That Address This Specific Exposure

Place a freeze on your credit reports at Equifax, Experian, and TransUnion. This prevents new accounts from being opened in your name even if someone has your Social Security number. It is the single most effective action available for this type of exposure.

Monitor your Explanation of Benefits statements from every health insurer you have ever used. Look for claims you did not file or services you did not receive. Medical identity theft often surfaces first through insurance paperwork.

File your taxes early each year. This reduces the window in which someone can file a fraudulent return using your Social Security number. If you receive a notice from the IRS that a return has already been filed in your name, respond immediately.

Review your medical records directly with every provider you have used. Request a full copy of your file at least once per year and check for entries that do not belong to you. Early detection is the only practical defense against medical identity theft.

Contact SOC, a Day & Zimmermann company directly if you have any doubt about whether you were included in this filing. Ask for confirmation in writing of exactly which records were exposed. Their notification obligation gives you the right to that clarity.