SunSource Borrower LLC Data Breach Notice (Vermont Attorney General)

The filing from SunSource Borrower LLC, reported to the Vermont Attorney General on June 17, 2026, states that health records belonging to one Vermont resident were exposed. Because this is a single-person incident, the organisation is required to notify the affected individual directly, usually by post. If you received such a letter, this notice concerns you. If you have not received one, it is likely your information was not included, though anyone who has moved since the incident should contact SunSource Borrower LLC directly to confirm their status.

Health Records Carry Lifelong Risk

When health records appear in a data breach, the consequences do not expire. Unlike a credit card number that can be replaced, medical information stays sensitive for decades. The exposed records can be used to commit insurance fraud, file false claims, or seek treatment under someone else’s identity. They can also enable discrimination in employment, housing, or insurance if details about diagnoses, treatments, or conditions become known to the wrong parties.

In this case the record lists only health records. No passwords, no Social Security numbers, and no permanent government identifiers were exposed. That is genuinely good news. It means the breach does not create the classic identity-theft cocktail that combines a name with a government ID and financial data. The primary ongoing risk is misuse of the medical information itself.

What the Single-Person Filing Tells Us

A breach affecting exactly one person is unusual in public filings. It suggests either a narrowly targeted incident or a very limited exposure discovered during an internal review. The Vermont notice does not disclose the root cause, whether the data was viewed, copied, or exfiltrated, or exactly when the incident occurred. What it does establish is that health records of one individual were involved and that the company has now fulfilled its legal obligation to report it.