-
Vanguard told the attorney general of Vermont that a breach exposed Social Security numbers for 94 residents.
-
A threat actor reportedly holds about 14 million Vanguard-linked records, but Vanguard has not confirmed that figure.
-
Three class action lawsuits are filed, and Vanguard is offering three years of free identity monitoring to affected people.
The US investment giant Vanguard has told a state regulator that a data breach exposed the Social Security numbers of people. The notice from the company covers 94 people in Vermont. A hacker separately claims to hold data on about 14 million people.
Vanguard has not given a total number of affected customers. The company also has not publicly confirmed the larger hacker claim. Three class action lawsuits are already filed.
What Vanguard Told Vermont
On November 4, 2026, Vanguard reported a breach to the Vermont Attorney General. The submission indicates that 94 people in the state suffered from the breach.
It does not indicate when the data breach took place or how hackers accomplished it. The filing does not specify when Vanguard notified the victims of the incident. The company has not published the total number of state residents.
Later, Vanguard described the data breach incident as a social engineering incident. This means that someone tricked a Vanguard employee into giving access to the attacker. The attacker was able to gain access to a cloud-based business application of Vanguard and not to entry level accounts of clients. According to the statement of Vanguard, the exposed information is not related to many people.
The filing in Vermont matters as it is a requirement by the law of the state. Vermont is one of many states that publishes breach notifications. Most times, such notices reveal many incidents that companies do not state completely and publicly.
The 14 Million Record Claim
In October, a hacker made a claim on the dark web forum. The hacker claimed he had stolen over 14 million records related to Vanguard. The claim received a flagged warning from a cybersecurity firm but the firm has classified the claim as unverifiable.
The data allegedly included SMS verification logs. The logs contained timestamps, phone numbers, countries, and mobile carriers. Such information would allow attackers to bypass a two-step verification process.
Meanwhile, Vanguard has not verified the 14 million claimed records. The company has not disclosed whether the post on the dark web is connected to the case in Vermont. Moreover, the discrepancy of 94 people and 14 million records remain unexplained.
The data sample also included technical details about the systems of the company. Specialists who analyzed the post stated that the format looked real, although they could not confirm the source. Nevertheless, this does not make it trustworthy. Also, a real breach does not always match the claims of a hacker.
The Lawsuits Already Filed
Three class actions followed the announcement. On November 6, 2026, one case came from a Vanguard client named John Peppard in federal court in Pennsylvania. The lawsuit claims that Vanguard kept sensitive information in a way that makes it susceptible to cyberattacks. It also states that the company did not notify the affected clients in a timely manner.
Michael Figueroa, a former Vanguard employee who worked at the company from 2019 to 2025 filed the next lawsuit on November 11. He states that he provided his social security number and driver’s license details to Vanguard for employment purposes. Also, he claims that the hack led to more scam calls and messages.
A third case has also been filed in federal court in Pennsylvania. The lawsuits seek class action status for a group of people from across the US, claiming negligence, breach of implied contract, & other accusations.
Furthermore, it could take years for resolution of the class action lawsuits. Companies often argue that the plaintiffs cannot prove damages the data leak caused. Courts are split on this matter, so the outcome is uncertain.
What Customers Should Do Now
Vanguard has provided complimentary identity monitoring services via Kroll for three years to people who the data breach affected. The company will communicate to those individuals this week.
Anyone who sees the notice should read it carefully. In addition, they should check the information regarding their exposed data type & note the deadline for enrollment in the monitoring program. It is important to archive the letter.
Customers should monitor phone calls, emails, & texts since they may fall prey to a scam. The breach started with a victim being tricked. Moreover, the exposure of personal information makes the scam easier to pull off. If one is not sure whether the message comes from the legitimate source, it is better to hang up the phone and call the listed numbers on the official Vanguard website.
Cybercriminals can also exploit trusted communication channels to spread misleading messages. In a separate incident, earlier this month, hackers hijacked emergency apps in Ukraine and Russia to send fake nuclear alerts, highlighting why people should verify alarming or unexpected messages through official sources.
For a compromised Social Security number, freezing credit with Equifax, Experian, and TransUnion is the best available solution. Freezing prevents lenders from checking the credit report, which stops the number of new accounts attackers can open in the name of the victim.
