McDermott Will & Schulte LLP Data Breach Notice (Vermont Attorney General): What Was Exposed & What To Do

A small number of people have been told that sensitive personal information held by McDermott Will & Schulte LLP may have been exposed in a data incident. The firm notified Vermont residents and reported the matter to the Vermont Attorney General on August 28, 2026. Public notice lists Social Security numbers and health records among the information involved, which raises concrete risks of identity misuse and privacy harm for those affected.

Only 15 people are reported as affected. That limited scale does not reduce the seriousness of the data types named. Anyone who receives a notice, or who has reason to believe their information was held by the firm in a matter involving health or identity details, should treat the disclosure as a prompt to monitor accounts and records rather than as a distant technical event.

Inside the incident

According to the breach notice filed with the Vermont Attorney General and reported on August 28, 2026, McDermott Will & Schulte LLP informed Vermont residents of a data breach. The filing states that Social Security numbers and health records were among the information exposed. The notice identifies 15 people as affected.

Public detail stops there. The available record does not describe how the incident occurred, whether systems were accessed remotely, how long any unauthorized access lasted, when the firm first detected the event, or what containment steps were taken. No dollar figures, file counts beyond the people-affected figure, or technical indicators are provided in the disclosed summary. No threat actor is named in the facts.

How a breach like this happens

Incidents that result in notices naming Social Security numbers and health-related records often follow familiar patterns, though none of these patterns is confirmed for this specific case. Attackers may obtain credentials through phishing, reuse of passwords from other breaches, or malware on an endpoint. Once inside a network or cloud workspace, they may search for document stores, email archives, or case-management systems that hold client files. In other cases, a misconfigured file share, a compromised vendor connection, or theft of a device can expose the same categories of data without a dramatic “break-in.”

Law firms and professional services organizations routinely handle concentrated collections of identity and medical information for litigation, transactions, regulatory work, or benefits matters. That concentration makes the material attractive if access controls fail. After exfiltration or exposure, criminals may attempt tax fraud, new-account fraud, medical identity misuse, or targeted social engineering that references real case details. None of this describes a proven method for the McDermott Will & Schulte LLP notice; it is general background on how breaches of this data type typically unfold when specifics are not published.

About McDermott Will & Schulte LLP

McDermott Will & Schulte LLP is a law firm. Firms of this kind advise corporate and individual clients on legal matters and commonly hold correspondence, contracts, discovery materials, employment or benefits files, and other records that can include government identifiers and health-related information. Even when a matter is not primarily medical, health details can appear in disability claims, personal-injury files, insurance disputes, or employee benefits work.

A breach at a law firm is consequential because the data is often highly specific to individuals and tied to ongoing or past legal issues. Clients and other parties may have shared information under an expectation of confidentiality. Exposure can affect not only financial identity but also privacy around medical conditions or legal strategy. The Vermont filing indicates the firm took the step of notifying residents and the state attorney general when it determined that certain residents’ information was involved.

What was likely exposed

The notice explicitly lists Social Security numbers and health records among the information exposed. Fifteen people are reported as affected. Beyond those named categories and the headcount, the public summary does not itemize every field, document type, or record format.

Organizations like large law firms typically hold, in the ordinary course of business, items such as full names, addresses, contact details, government identifiers, medical or insurance-related documents when relevant to a matter, and case files. Whether any given individual had only a subset of those elements involved is unconfirmed in the public notice. Readers should rely on the firm’s direct notification for personal confirmation rather than assuming a full dossier was taken.

Why it matters

Social Security numbers remain a primary key for opening credit accounts, filing fraudulent tax returns, and impersonating someone with employers or government agencies. Health records can support medical identity theft, false insurance claims, or embarrassment and discrimination if sensitive diagnoses or treatment details circulate. Even a small affected population faces those risks if the data is accurate and current.

For the firm, the incident carries regulatory notification duties, potential contractual obligations to clients, and reputational pressure to demonstrate improved controls. For individuals, the practical stakes are monitoring for unexplained credit activity, tax transcripts that do not match their filings, and medical bills or insurance explanations of benefits for care they did not receive. The limited number of people reported does not eliminate those individual harms; it simply narrows the circle of people who need to act.

If your data was in this breach

If you received a notice from McDermott Will & Schulte LLP, or if you believe the firm held your Social Security number or health information in a relevant matter, take measured steps:

• Read the notice carefully for any reference numbers, dates, and offered services such as credit monitoring.
• Place a fraud alert or credit freeze with the major consumer credit bureaus if you have not already done so.
• Review credit reports and IRS online account activity for unfamiliar inquiries or filings.
• Check explanation-of-benefits statements and medical bills for services you did not receive.
• Use unique, strong passwords and multi-factor authentication on email and financial accounts so a single exposed identifier is harder to exploit.
• Keep the notice and any related correspondence; they can help if you later need to dispute fraud.

You can also run a free exposure scan of your email address to see whether that address has appeared in other known breach datasets. That check does not replace the firm’s notice, but it can show whether your email is already circulating in broader breach collections and help you prioritize password changes and monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.