Superb Shifts, Inc. Data Breach Notice (Vermont Attorney General)

The filing from Superb Shifts, Inc. means that two Vermont residents now have their Social Security Numbers and Government ID Numbers in the hands of an unknown party. Because these identifiers never expire and cannot be reissued like a credit card or password, the exposure creates a permanent risk of identity theft and fraud that will remain for decades.

A Social Security Number Is a Lifelong Key

Unlike passwords, which can be changed, or credit cards that can be replaced, a Social Security Number is fixed for life. Once it is exposed, it stays exposed. The same is true for Government ID Numbers. The Vermont Attorney General’s filing on July 31, 2026 lists exactly these two categories and no others. No passwords were exposed. No financial account numbers were listed. No medical information appears in the record.

For the two people named in this notice, that single fact changes how they must protect themselves going forward. Anyone who receives a letter from Superb Shifts should treat their SSN as permanently compromised. The company is required by law to notify affected individuals directly, usually by post. If you have not received such a letter, it is likely you were not among the two people included. However, if you have moved since the incident occurred, contact Superb Shifts directly to confirm whether your records were involved.

What This Exposure Actually Enables

With a Social Security Number and a matching Government ID, thieves can attempt to file fraudulent tax returns, open new bank accounts, apply for government benefits, or impersonate you when seeking employment. These crimes can go undetected for years because the victim rarely learns about them until they file taxes or receive an unexpected bill from a collection agency.

The small number of people affected — just two — does not reduce the severity for those individuals. When the data involved is this sensitive and this permanent, scale is secondary to the quality of what was lost.

The Filing Date Is All We Have

The record filed with the Vermont Attorney General on July 31, 2026 does not state when the incident itself occurred. Without that date, it is impossible to measure how long the information may have been accessible or when the company first learned of the problem. The filing simply establishes that the exposure happened and that notification has now been made.

This lack of timeline information is common in these attorney general filings. It leaves affected individuals without clear guidance on exactly when they should begin watching for signs of identity theft. The safest assumption is that the risk begins now and continues indefinitely.

Why Government IDs Matter Long After the Breach

Government ID Numbers are frequently used as a secondary form of verification. When paired with a Social Security Number, they allow criminals to bypass many automated fraud checks. A stolen driver’s license number or state ID number does not expire when you renew the physical card. The underlying identifier remains the same.

Because the record lists only these permanent identifiers, the standard advice to “change your passwords” does not apply here. No account credentials were exposed. The real work lies in monitoring and restricting what can be done with your unchanging government identifiers.

Protecting Yourself When the Data Cannot Be Changed

Place a freeze on your credit reports with Equifax, Experian, and TransUnion. This prevents new accounts from being opened in your name without your explicit permission. The freeze is free, reversible when you need to apply for credit, and one of the most effective steps available once an SSN is known to be compromised.

Monitor your tax filings closely. Set up an IRS online account so you can see filings made in your name. Consider filing Form 14039, an Identity Theft Affidavit, with the IRS to flag your account for extra scrutiny. This does not prevent fraud but makes it easier to resolve if someone tries to claim a refund using your number.

Review every Explanation of Benefits statement from health insurers and every tax transcript from the IRS. Look for services or income you do not recognize. Because medical and financial account data were not listed in the filing, the primary risk remains identity fraud rather than direct medical or banking theft.

Be extremely cautious with any unsolicited calls, texts, or emails that ask you to confirm your Social Security Number or Government ID details. Criminals who possess this data often pose as legitimate organizations to harvest additional information.

If you receive a letter from Superb Shifts, keep it. The letter will specify exactly which of your records were involved and will likely include instructions for credit monitoring or identity protection services the company is offering. Even if you decide not to use those services, the letter serves as proof that your information was exposed if problems arise later.

The two-person scope of this filing is unusually small. Most breach notices involve thousands or tens of thousands of records. That does not make the incident insignificant for the people affected. When the data lost consists of permanent government identifiers, the consequences are measured in years and decades rather than in the size of the immediate list.