November 4, 2026: The Vanguard Group, the Pennsylvania-based investment manager, filed a security breach notice with the Vermont Attorney General. The filing lists Social Security numbers for 94 Vermont residents. Vanguard has not published a statement, a cause or a national total. The catalog entry records the filing.
What is known
- The Vermont listing is dated November 4, 2026, in the financial services sector.
- It lists 94 Vermont residents and the data type "Social Security Numbers".
- Vermont requires a preliminary notice to the Attorney General within 14 business days of discovery and consumer notices within 45 days, so letters should be reaching people around now.
What is not known
- The cause. Large firms file notices for many reasons, from cyberattacks and vendor breaches to misdirected mail and account takeovers.
- When it happened, how many people were notified nationally, and whether account numbers or balances were involved.
- Whether it is linked to Vanguard's earlier notices. Vanguard filed a notice with Massachusetts regulators in February 2026 and another in 2024 about accounts accessed with stolen credentials.
Vermont no longer posts copies of consumer letters, so the notice text is not public. Ninety-four Vermonters suggests the national total is in the thousands, though that is an inference, not a reported figure.
Who is at risk
Vanguard investors and retirement-plan participants who receive a letter. A Social Security number with a name allows identity theft. For investment accounts, the bigger worry is account takeover: criminals using personal details to pass phone verification, reset passwords or redirect withdrawals.
What to do
- Read any Vanguard letter and enrol in any credit monitoring offered.
- Log in to Vanguard directly (not through an emailed link) and check your contact details, linked bank accounts and recent transactions.
- Turn on Vanguard's two-step verification, preferably with a security key or authenticator app rather than SMS.
- Freeze your credit with Equifax, Experian and TransUnion.
- Be wary of calls or emails claiming to be from Vanguard about "suspicious activity" that ask you to confirm details or move money. Call back on the number on Vanguard's website.
Sources
- Vermont Attorney General, Security Breach Notices (listing dated November 4, 2026)
- ClassAction.org, November 5, 2026
Sourcing note: the Vermont listing is the only official record. The ClassAction.org page is a law-firm solicitation that repeats it. We will update this post if Vanguard publishes details.