SunSource Borrower LLC (“SunSource”) Data Breach Notice (Massachusetts Attorney General)

The filing from SunSource Borrower LLC has placed your Social Security number, driver’s license number, medical records, financial account numbers, and credit or debit card numbers among the records of 193 Massachusetts residents exposed in this incident. Because a Social Security number cannot be replaced, this exposure creates lifelong risks that most other data breaches do not.

That single permanent identifier, paired with any of the other categories listed in the June 17, 2026 filing, gives fraudsters the raw material to open accounts, file false tax returns, obtain medical services in your name, or build synthetic identities. The record does not state whether the data was copied or simply viewed, but the categories themselves are now presumed to be outside SunSource’s control.

Your Social Security Number Is Now a Permanent Key

A Social Security number cannot be reissued at will the way a credit card or driver’s license can. Once it is loose, it remains a valid identifier for the rest of your life. The Massachusetts filing lists Social Security numbers alongside driver’s license numbers for the same 193 people. That combination is exactly what lenders, government agencies, and insurers rely on to confirm identity. Criminals use the same pair to create synthetic identities—fabricated profiles built from real stolen documents—that can generate debt, fraudulent tax refunds, and medical claims charged to your name.

Medical records listed in the filing add another dimension. Health information tied to your SSN can be used to file false insurance claims, order prescription drugs, or request treatment that later appears on your Explanation of Benefits. These records do not expire. A fraudulent medical claim filed today can surface years from now when you apply for life insurance or a new job that requires a medical history review.

What Financial Account and Card Numbers Enable

The filing also names financial account numbers and credit or debit card numbers. These can be used for immediate unauthorized withdrawals or charges. Unlike an SSN, however, the reader retains some control: cards can be canceled, accounts can be frozen, and banks must typically reimburse fraudulent transactions if reported promptly. The presence of these categories means you should treat every linked account as potentially compromised even if no fraudulent activity has appeared yet.

No passwords were exposed in this incident. That is genuine good news. You do not need to reset any SunSource credentials, and the account itself is not at direct risk of remote takeover. The danger lies entirely in the non-revocable and semi-permanent identifiers that were listed.

How to Determine Whether This Filing Affects You

SunSource is required to notify affected Massachusetts residents directly, usually by mail. If you have not received a letter, your information was most likely not included in the group of 193. Letters can be delayed or misdelivered, however. Anyone who has changed address since the incident should contact SunSource directly to confirm whether their records were among those exposed. The filing does not disclose when the incident occurred, so the letter remains the only practical way to verify your status.

The Lifelong Value of Stolen Medical and Identity Data

Unlike credit card numbers that lose usefulness once canceled, the combination of an SSN, driver’s license, and medical records retains value for identity thieves for decades. Fraudsters do not need every category for every scheme. A single realistic-looking medical claim using your SSN can generate thousands of dollars before detection. A driver’s license number paired with your SSN can help bypass knowledge-based authentication at banks or government portals.

Because the record lists these categories together for the affected population, the 193 individuals face overlapping risks rather than isolated ones. Medical identity theft in particular is difficult to spot. You may not learn about it until a debt collector contacts you for services you never received or your insurance premiums rise because of claims filed under your name.

Concrete Risks That Remain Under Your Control

While you cannot change your Social Security number, you can limit what criminals do with it. Placing a freeze on your credit files at the three major bureaus prevents new accounts from being opened in your name without your explicit permission. Monitoring your Explanation of Benefits statements from every health insurer you use lets you catch fraudulent medical claims early. Regularly reviewing bank and credit card statements remains essential even after cards are replaced, because new account numbers can be created from the underlying financial data listed in the filing.

The scale—exactly 193 people—does not by itself indicate sophistication or carelessness on SunSource’s part. It simply tells us that a relatively small but highly sensitive set of Massachusetts residents now carry elevated identity risk because of this incident.

Why Medical Records Change the Equation

Most people think of data breaches in terms of financial loss. The inclusion of medical records shifts the harm toward long-term fraud that is harder to reverse. A fraudulent medical record can affect future treatment decisions if incorrect information enters your permanent health file. It can also trigger insurance denials if the carrier believes you have already received procedures you have not. These consequences can appear months or years after the initial theft, which is why ongoing vigilance matters more than a one-time check.

The filing lists medical records as one of the exposed categories but does not describe the type or depth of those records. In practice this means anyone notified should assume the information is detailed enough to support a convincing fraudulent claim.

Practical Steps Specific to This Exposure

• Place a security freeze on your credit reports at Equifax, Experian, and TransUnion. This is the single most effective step against new-account fraud using your exposed SSN and driver’s license.
• Contact every health insurer you have used in the past several years and ask them to flag your file for review. Request that they send you an Explanation of Benefits for every claim going forward.
• Replace any affected credit or debit cards immediately and monitor the linked accounts daily for the next several months. Even small test charges can reveal whether the numbers are in active use.
• Set up alerts with the IRS and your state tax authority to be notified of any filings under your SSN. Identity thieves frequently file early to claim refunds.
• Review your annual credit reports from all three bureaus every four months instead of once a year. Look for accounts or inquiries you do not recognize.

This incident does not require panic, but it does require sustained attention. The Social Security number at the center of the SunSource filing cannot be revoked. The medical records cannot be unpublished. What you can still control is how quickly you detect and respond when someone attempts to use them. The letter you may receive from SunSource is the definitive signal that these specific records were involved. Until that letter arrives or you confirm your status directly with the organization, treat the possibility seriously but act on the risks you can still limit.