Todd Rowe Data Breach Notice (Vermont Attorney General)

The filing from Todd Rowe, reported to the Vermont Attorney General on June 09, 2026, states that the personal information of five people was exposed. The categories named are Social Security Numbers and Government ID Numbers.

If you received a letter, this exposure is permanent

Social Security Numbers and Government ID Numbers do not expire. They cannot be cancelled or replaced the way a credit card or password can. Once they leave the organisation’s control, they remain usable for identity theft and fraud indefinitely. That is the core reality this notice creates for the five individuals named in it.

The record does not state when the incident occurred, only that the filing reached the Vermont Attorney General on June 09, 2026. It also does not disclose whether the data was stolen, accidentally exposed, or shared improperly. What matters to you is that these two categories are now outside the organisation’s protection.

What these specific numbers enable

A Social Security Number combined with a Government ID Number gives someone the foundational pieces required to open accounts, file fraudulent tax returns, apply for government benefits, or create synthetic identities. These two pieces of information together are treated as high-value precisely because they are permanent identifiers issued by the federal government.

No passwords were exposed. No financial account numbers appear in the filing. The record lists only these two categories. That absence is meaningful: it means the immediate risk is tied to long-term identity fraud rather than instant account takeover.

The letter is the only reliable way to know if you are one of the five

Todd Rowe is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your information was not included. However, letters go to the last known address. Anyone who has moved since the incident should contact Todd Rowe directly to confirm whether their records were part of this filing.

Because the filing does not give an incident date, there is no way to calculate how long ago the exposure happened. The letter remains the single practical test available.

Why the small number does not reduce your risk if you are affected

Five people is a very small group. For those five, however, the sensitivity of the data is unchanged. A Social Security Number does not become less valuable because only a handful of them were exposed. The risk to each person whose number was included remains the same: it can be used for years.

The filing lists these categories for the incident as a whole. Your own notification letter will specify which exact pieces of information applied to you.

What you can still control

Even though the identifiers cannot be changed, you retain several practical levers that limit what thieves can do with them.

First, place a freeze on your credit reports at Equifax, Experian, and TransUnion. A freeze stops new credit applications from being approved without your explicit permission. It is the single most effective step against new-account fraud that uses a stolen Social Security Number.

Second, set up alerts with the IRS and your state tax authority so you are notified immediately of any tax return filed in your name. Early detection prevents the cascade of problems that follows a fraudulent filing.

Third, monitor your existing financial accounts and government benefits statements closely. While no banking details were listed in the filing, thieves who obtain a Social Security Number often test it against multiple systems over time.

Fourth, consider identity theft protection services that include dark-web monitoring for your Social Security Number and Government ID Numbers. These services will alert you if the specific identifiers appear for sale or in breach repositories.

Fifth, keep every piece of correspondence related to this notice. If identity theft occurs later, these documents establish when you first learned of the exposure and support any disputes with banks, credit bureaus, or government agencies.

The exposure of these permanent identifiers creates a risk that lasts for years rather than weeks. The filing itself is brief and contains no further details about cause or scope. What it does establish clearly is that five Vermont residents now face an indefinite identity-fraud risk that cannot be eliminated, only managed.

The record supports no conclusions about how the data left Todd Rowe’s control. It supports no statements about the organisation’s size, security practices, or vendors. It simply records that the exposure happened and names the categories and the number of people involved.