The Devereux Foundation Data Breach Notice (Vermont Attorney General)

The Devereux Foundation has notified 43 Vermont residents that their Social Security numbers, government ID numbers, and health records were exposed in a data breach. The filing, submitted to the Vermont Attorney General on July 23, 2026, confirms these three categories were involved. No other details about the cause or method are disclosed.

Your Social Security Number Cannot Be Replaced

If you received a letter from The Devereux Foundation, one of the most serious elements is the exposure of your Social Security number. Unlike a credit card or password, a Social Security number is permanent. It cannot be reissued on request the way other credentials can. Once it is out of the organisation’s control, it remains a lifelong tool that identity thieves can use to open accounts, file fraudulent tax returns, or claim government benefits in your name.

Government ID numbers listed in the filing carry similar long-term risk. These identifiers tie directly to official records and do not expire. Their value to criminals does not diminish after months or even years.

Health Records Create Additional Lifelong Exposure

The filing also lists health records among the exposed information. This category can include details that feel deeply personal. When combined with a Social Security number, medical information can be used for insurance fraud, prescription scams, or blackmail. Unlike financial accounts that can be closed or monitored, health history cannot be changed. The exposure creates a permanent record that could surface in unexpected ways for decades.

The record does not state that passwords were exposed. This is genuinely good news. You do not need to reset any Devereux Foundation password in response to this incident, and there is no indication that account access itself was compromised through stolen credentials.

What the 43-Person Scope Actually Means

Only 43 Vermont residents are named in this filing. That small number does not reduce the seriousness for those affected. Each person whose records were included now faces the same permanent risks outlined above. The filing does not disclose whether the data was copied and exfiltrated or simply viewed. It also does not specify when the incident occurred, only that the organisation filed the notice on July 23, 2026.

Because the filing does not give an incident date, there is no reliable way to apply a “have you moved” test. The only practical way to determine whether you are affected is to wait for direct notification from The Devereux Foundation. The organisation is required to notify affected individuals directly, usually by post. If you have not received a letter, it is likely your information was not included. However, anyone who has changed addresses since receiving services from the organisation should contact them directly to confirm their status.

Why These Specific Categories Matter More Than Most

Social Security numbers and government IDs do not lose their value over time the way credit card numbers do. Thieves can use them years later when combined with other publicly available scraps of information. Health records add a layer that many people underestimate. Medical diagnoses, treatment history, or insurance details can be leveraged for targeted fraud or sold on underground markets where identity packages that include both government identifiers and medical data command higher prices precisely because they are harder to invalidate.

The combination of these three categories in a single incident increases the potential for sophisticated identity theft. A criminal who obtains your Social Security number and health records can more convincingly impersonate you when dealing with insurers, government agencies, or lenders.

The Limits of What This Filing Tells Us

This notice establishes only that the exposure occurred and that 43 Vermont residents were affected. It does not reveal how the breach happened, how long any unauthorised access lasted, or whether the data left the organisation’s systems. Those details remain undisclosed. The record also does not name any third-party vendor or suggest the breach resulted from a specific failure beyond the fact that the information was exposed.

Speculation about the organisation’s security practices would go beyond what the filing supports. The only facts available are the categories exposed, the number of people, and the filing date.

Protecting Yourself When Identifiers Cannot Be Changed

Because your Social Security number and health history cannot be replaced, the focus shifts to detection and monitoring. You retain control over how closely you watch for misuse. Early detection remains the most effective defense against the permanent risks created by this exposure.

Place a fraud alert or credit freeze with the major credit bureaus so new accounts cannot be opened without your explicit permission. Review every Explanation of Benefits statement from your health insurer for services you did not receive. Tax transcripts from the IRS should be monitored annually for fraudulent filings made with your Social Security number.

These steps do not undo the exposure, but they limit what criminals can successfully do with the information. The filing confirms the data was exposed; what happens next depends on how carefully the affected individuals respond.

The Devereux Foundation is obligated to provide additional information to anyone it directly notifies. If you believe you may have been affected but have not received correspondence, contacting the organisation remains the only way to receive confirmation from the source that holds the original records.