McDermott Will & Schulte LLP notified the Vermont Attorney General in August 2026 that a data breach exposed Social Security numbers and health records. The number of people affected has not been publicly disclosed. If you receive a notification letter, place a credit freeze and monitor your accounts immediately to guard against identity theft and medical fraud.
| Company | McDermott Will & Schulte LLP |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Social Security Numbers, Health Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Vermont Attorney General |
What Happened in the McDermott Will & Schulte LLP Data Breach?
McDermott Will & Schulte LLP recently disclosed a data breach that exposed sensitive personal information belonging to individuals connected to the firm. The law firm filed formal notice of the incident with the Vermont Attorney General in August 2026. This filing confirmed that unauthorized parties had access to files containing Social Security numbers and health records.
The exact discovery date of the McDermott Will & Schulte LLP data breach has not been publicly disclosed. However, the firm’s decision to file a formal notice indicates that its internal review confirmed exposure of personal data. As a result, affected individuals are now being notified so they can take steps to protect themselves.
Details about the specific attack method have not been made public. Law firms often store large volumes of sensitive client and case-related data, which makes them attractive targets for cybercriminals. Because legal files frequently include health records and financial identifiers, any unauthorized access can carry serious consequences for the people named in those documents.
Following discovery, McDermott Will & Schulte LLP appears to have launched an internal investigation to determine the scope of the exposure. This process typically involves identifying which systems were accessed, what data was involved, and which individuals need to be notified. The firm then moved to satisfy its legal obligations by reporting the incident to state regulators.
Who was affected?
McDermott Will & Schulte LLP data breach.
Placeholder
Who was affected?
The individuals affected by this incident likely include clients, former clients, or other parties whose personal information was handled by the firm. Because law firms manage sensitive matters involving litigation, estate planning, and healthcare-related cases, the affected population may include people from multiple states, not just Vermont residents.
The exact number of people affected by the McDermott Will & Schulte LLP data breach has not been publicly disclosed. In addition, the firm has not released specific details about the categories of individuals impacted, such as whether they were clients, employees, or third parties connected to legal matters. Given that health records were involved, it is possible that medical patients tied to legal proceedings were also affected.
Because the breach touches on health information, there is a possibility that vulnerable populations, including minors involved in legal proceedings, could be part of the affected group. Anyone who has worked with or been referenced in matters handled by this firm should consider themselves potentially impacted until they receive official confirmation either way.
What Information Was Potentially Exposed?
According to the breach notification filed with the Vermont Attorney General, two major categories of sensitive data were involved in this incident. This combination of identifiers creates significant risk because it merges financial identity data with private medical information.
- Social Security Numbers
- Health Records
This type of exposure raises serious concerns for identity theft. Social Security numbers remain one of the most valuable pieces of data for criminals because they can be used to open new credit accounts, file fraudulent tax returns, or apply for loans in someone else’s name. Once exposed, this information cannot be changed like a password, so the risk can persist for years.
Health records add another layer of danger. Criminals can use stolen medical information to commit healthcare fraud, such as billing insurance providers for services never received. In addition, exposed health details can be used for targeted phishing scams that reference real medical conditions or treatments to appear more convincing. Because this data is deeply personal, its exposure can also cause significant emotional distress for those affected.
What is the company doing?
In response to the breach, McDermott Will & Schulte LLP took steps to investigate the incident and notify affected individuals as required by law. The firm filed a formal breach notification with state regulators, which is a legally mandated step once a data exposure involving personal information is confirmed.
Specifically, McDermott Will & Schulte LLP filed notice with the Vermont Attorney General. This filing formally documented the categories of data involved and satisfied the firm’s disclosure obligations under state breach notification law.
Beyond regulatory filings, organizations that experience a breach of this nature typically review their security practices to prevent future incidents. This can include strengthening network defenses, adding new monitoring tools, and reassessing internal data-handling procedures. While the firm has not publicly detailed every remediation step, affected individuals should watch for a direct notification letter that may include further guidance or protective service offers.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone connected to the McDermott Will & Schulte LLP data breach should begin monitoring their credit reports right away. Because Social Security numbers were involved, criminals could attempt to open new accounts or credit lines using stolen identities.
You can request a free credit report from each of the three major credit bureaus. Reviewing these reports regularly helps you catch unfamiliar accounts or inquiries early. If you notice anything suspicious, report it immediately to the credit bureau and consider filing a police report.
Consider a Fraud Alert or Credit Freeze
Given the exposure of Social Security numbers, placing a fraud alert or credit freeze is a strong protective step. A fraud alert requires lenders to verify your identity before opening new credit, while a credit freeze blocks access to your credit file entirely.
Both options are free and can be requested directly through the credit bureaus. Although a freeze offers stronger protection, it does require you to lift it temporarily whenever you apply for new credit. Because this breach involved highly sensitive identifiers, many security experts recommend a freeze over an alert alone.
Protect Yourself Against Healthcare Fraud
Because health records were exposed, affected individuals should also watch for signs of medical identity theft. This can include unexpected medical bills, unfamiliar insurance claims, or notices about services you never received.
Reviewing your insurance statements regularly can help you spot fraudulent activity early. If anything looks unfamiliar, contact your insurance provider right away. In addition, request copies of your medical records periodically to confirm they accurately reflect your actual treatment history.
Stay Alert for Phishing Attempts
After a data breach involving personal and health information, phishing attacks often increase. Scammers may use exposed details to craft convincing emails, texts, or phone calls pretending to be legitimate organizations.
Always verify the sender before clicking links or sharing information. If you receive a message referencing this breach, contact the company directly using a verified phone number rather than replying. Because scammers rely on urgency and fear, taking a moment to pause before responding can prevent further harm.
Consult a Data Breach Attorney
If you received a notification about the McDermott Will & Schulte LLP data breach, it may be worth speaking with an attorney who focuses on data breach cases. They can help you understand your rights and whether you qualify for compensation.
Many attorneys offer free consultations to review your situation. Because exposure of Social Security numbers and health records can lead to long-term risks, getting professional guidance early can help you make informed decisions about protecting your identity and pursuing any available legal remedies.
More Information
View the public data breach notification listing from Vermont Attorney General