PeoplesBank notified the Vermont Attorney General in September 2026 that a data breach exposed government ID numbers and biometric information belonging to customers. The exact number of affected individuals and how the breach occurred have not been publicly disclosed. Affected individuals should monitor credit reports, consider a credit freeze, and watch for official notification letters from the bank.
| Company | PeoplesBank |
|---|---|
| Industry | Finance |
| Data Types Exposed | Government ID Numbers, Biometric Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Vermont Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the PeoplesBank Data Breach?
PeoplesBank recently filed a formal data breach notification with the Vermont Attorney General. This filing confirmed that unauthorized parties accessed sensitive personal information belonging to customers. As a result, the bank now joins a growing list of financial institutions dealing with data security incidents this year.
According to the filing, the breach involved government ID numbers and biometric information. However, the bank has not publicly disclosed the exact date it discovered the intrusion. Similarly, details about the specific method attackers used to gain access remain unavailable at this time.
The notification to Vermont regulators occurred in September 2026. This step is a required part of state breach notification law. Because banks handle highly sensitive financial and identity data, regulators require prompt disclosure once a breach is confirmed.
At this stage, PeoplesBank has not released a detailed public account of how the breach unfolded. Therefore, many specifics about the timeline and attacker methods are still unknown. Additional information may emerge as state attorneys general and affected customers receive further updates.
Who was affected?
The PeoplesBank data breach likely affects customers whose personal information the bank stores as part of routine banking operations. This may include checking account holders, loan customers, or individuals who used biometric verification for account access. However, the exact number of affected individuals has not been publicly disclosed.
Because the bank filed notification with the Vermont Attorney General, at least some Vermont residents are confirmed to be impacted. That said, banks often serve customers across multiple states. As a result, the true geographic scope of this breach could extend beyond Vermont alone.
It also remains unclear whether the exposed data includes information belonging to minors or joint account holders. Given that biometric data was involved, the incident may affect customers who used fingerprint or facial recognition features. This raises unique concerns compared to a typical password-only breach.
What Information Was Potentially Exposed?
The Vermont Attorney General filing specifies two categories of exposed data. These categories represent particularly sensitive forms of personal identification. Unlike a leaked email address or username, this type of data is difficult or impossible to change once compromised.
- Government ID numbers
- Biometric information
Government ID numbers, such as driver’s license or state identification numbers, can allow criminals to impersonate victims. For instance, fraudsters may use these numbers to open new accounts or file fraudulent tax returns. In addition, this data is often used to verify identity across many industries, increasing the danger if it falls into the wrong hands.
Biometric information carries its own distinct risks. Unlike a password, a fingerprint or facial scan cannot simply be reset after exposure. Consequently, if biometric data is misused, victims may face long-term risks tied to identity verification systems that rely on that same biometric marker.
What is the company doing?
PeoplesBank filed a formal notification with the Vermont Attorney General to comply with state breach disclosure laws. This filing indicates the bank has acknowledged the incident to regulators. The bank also filed formal notification with the Vermont Attorney General, as required under state law.
Beyond this regulatory filing, the source material does not describe additional remediation steps the bank has taken. Therefore, it is not yet confirmed whether PeoplesBank is offering credit monitoring or identity protection services to affected customers. Individuals concerned about their exposure should watch for a direct notification letter from the bank, which typically outlines specific next steps and any available protections.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should check their credit reports regularly for unfamiliar accounts or inquiries. You can request free credit reports from all three major credit bureaus through AnnualCreditReport.com. Reviewing these reports often is one of the simplest ways to catch fraud early.
Because government ID numbers were exposed, criminals could attempt to open new credit lines in your name. As a result, catching suspicious activity quickly can prevent significant financial damage. Consider setting a recurring reminder to check your reports every few months going forward.
Consider a Credit Freeze or Fraud Alert
Given that government ID numbers were involved in this breach, placing a credit freeze is a strong protective step. A freeze restricts access to your credit file, making it harder for criminals to open accounts in your name. You can request a freeze directly through Equifax, Experian, and TransUnion.
Alternatively, a fraud alert requires creditors to verify your identity before extending credit. This option is less restrictive than a full freeze but still adds a meaningful layer of protection. Either step can significantly reduce your risk of becoming a victim of new-account fraud.
Stay Alert for Phishing Attempts
After a data breach, scammers often send phishing emails or texts pretending to be the breached company. Because your personal information may now be in criminal hands, these messages can appear highly convincing. Always verify unexpected requests for personal information before responding.
Instead of clicking links in unsolicited messages, go directly to the bank’s official website or call customer service using a verified number. This simple habit can prevent you from unknowingly handing over additional sensitive information. Be especially cautious of messages creating urgency or threatening account suspension.
Protect Your Biometric Data Footprint
Since biometric information was exposed, consider reviewing which apps and devices use your fingerprint or facial recognition data. Where possible, disable biometric login features on accounts holding sensitive financial information. This reduces the number of systems relying on data that cannot be changed.
In addition, ask your bank whether alternative verification methods are available going forward. Because biometric identifiers are permanent, extra caution here is warranted. Staying informed about how your bank secures biometric systems can help you make better decisions about which services to trust.
Consult a Data Breach Attorney
If you received a notification letter about this breach, it may be worth speaking with a data breach attorney. Many offer free case evaluations to help you understand your legal options. This is especially relevant given the sensitivity of government ID and biometric data involved.
Furthermore, an attorney can help determine whether you qualify for compensation through a class action or individual claim. Because deadlines for legal action can be limited, acting sooner rather than later is generally advisable. A free consultation carries no obligation and can clarify your rights.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
View the public data breach notification listing from Vermont Attorney General