Yellow Corporation and its affiliated debtors Data Breach Notice (Washington Attorney General)

The filing from the Washington Attorney General shows that on March 27, 2025, Yellow Corporation and its affiliated debtors experienced a data breach that was not reported until June 26, 2026 — an interval of 456 days, or about 15 months. The notice lists eight categories of information exposed: name, Social Security number, driver’s license or Washington ID card number, financial and banking information, full date of birth, passport number, health insurance policy or ID number, and medical information. The record does not state how many people were affected.

Your Social Security Number and Date of Birth Are Now in Someone Else’s Hands

If you received a notification letter from Yellow Corporation, this combination of permanent identifiers is the single most serious part of the exposure. A name paired with a Social Security number and full date of birth is the standard set of credentials used to open new credit accounts, file fraudulent tax returns, or apply for government benefits in another person’s name. These pieces of information cannot be replaced the way a credit card or password can. Once they are out, they remain valuable to identity thieves for years.

The same filing also includes your driver’s license number, passport number, and financial and banking details. Any one of those fields makes it easier for someone to impersonate you when dealing with banks, insurers, or government agencies. Medical information and health insurance policy numbers add another permanent risk: they can be used to file false claims against your insurance or to access your health records.

No Passwords Were Exposed

The notice contains no mention of passwords, login credentials, or any hashed credentials. This is genuinely good news. You do not need to change any password connected to Yellow Corporation because none was compromised in this incident. The risk here is not account takeover. It is long-term identity theft built on biographic and financial data that cannot be rotated.

What the 15-Month Gap Actually Means for You

The breach occurred on March 27, 2025. The filing reached the Washington Attorney General on June 26, 2026. State notification rules allow time for investigation and for confirming which individuals were affected. The record does not disclose when Yellow Corporation first discovered the incident or whether data was copied and removed. What matters to you is that the information has had more than a year to circulate before any official notice reached Washington residents.

Because the incident date is known, the practical test is straightforward: if you have moved since March 27, 2025, the letter may have gone to an old address. Absence of a letter usually means your records were not included, but anyone who changed residence after the incident date should contact Yellow Corporation directly to confirm their status.

How These Specific Categories Create Long-Term Risk

A Social Security number combined with a date of birth is the exact pair required to open credit in someone else’s name. Adding a driver’s license or passport number allows an impostor to obtain official documents or pass identity checks that most companies rely on. Financial and banking information can be used to add authorized-user status to existing accounts or to redirect legitimate payments.

Medical information and health insurance numbers create a different but equally persistent problem. Fraudulent medical claims can appear on your insurance history, potentially affecting future coverage or premiums. These records tie directly to your healthcare history and cannot be reissued like a compromised credit card.

The filing lists these categories for the incident as a whole. Your individual notification letter is the only document that can tell you which specific pieces of information about you were included.

The Records That Cannot Be Changed

Unlike a credit card number that can be canceled and replaced within days, a Social Security number, date of birth, driver’s license number, and passport number are permanent. Medical history and health insurance identifiers are equally fixed. Once they are exposed, the only realistic defense is constant vigilance: monitoring for new accounts opened in your name, unexpected tax filings, or claims against your insurance that you did not make.

This is why the exposure of these particular fields matters more than a typical retail breach that releases only payment card data. The information listed in this filing retains its criminal value long after the initial news cycle ends.

Concrete Steps That Match This Exposure

Place a fraud alert with the three major credit bureaus immediately. This forces lenders to verify your identity before opening new accounts and gives you early warning if someone tries to use your Social Security number.

Review your Explanation of Benefits statements from every health insurer you have used in the past several years. Look for claims you did not file or services you did not receive. Report anything suspicious to your insurer right away.

Obtain and examine your credit reports from Equifax, Experian, and TransUnion. Dispute any account or inquiry you do not recognize. Do this now and repeat the check every four months for at least the next two years.

Consider placing a credit freeze if you do not expect to apply for new credit soon. A freeze stops new accounts from being opened in your name until you lift it, providing stronger protection than a fraud alert alone.

Contact Yellow Corporation directly if you have moved since March 2025 or if you have any doubt whether you were included. Ask for a copy of the exact record they hold on you so you know which categories actually apply to your case.

These steps will not undo the exposure, but they give you the practical control that remains available once name, Social Security number, date of birth, and government identifiers are no longer private.