United Seating and Mobility LLC dba Numotion Data Breach Notice (Indiana Attorney General): What Was Exposed & What To Do

Inside the incident

United Seating and Mobility LLC, doing business as Numotion, notified Indiana residents of a data breach in a filing reported to the Indiana Attorney General on May 22, 2026. According to that filing, the underlying incident itself occurred on February 1, 2026. The notice states that 24 people were affected. Public detail beyond these points remains limited.

The disclosure identifies the exposed material only as personal information, without further breakdown of specific fields, systems involved, or the technical path of the incident. No additional counts, file volumes, dollar figures, or forensic findings appear in the reported summary. Attribution to any particular threat group is absent from the available record, and the method of unauthorized access or exposure has not been described in the filing.

What is known, therefore, is narrow but concrete: a company operating under the Numotion name experienced an incident dated February 1, 2026, later reported the matter to Indiana authorities on May 22, 2026, and indicated that personal information belonging to 24 individuals was involved. Timing between the incident date and the regulatory filing spans roughly three and a half months; the reasons for that interval are not stated in the public notice.

How a breach like this happens

Incidents that lead to notices of this kind typically begin with some form of unauthorized access to systems or records that hold personal data. Common pathways, in general terms and not specific to this case, include compromised credentials, phishing that yields remote access, misconfigured cloud storage, vulnerable remote-access services, or malware that enables data collection. Once inside an environment, an attacker or unauthorized process may locate files, databases, or backups containing names, contact details, identifiers, or other personal records.

Organizations often discover such events through internal monitoring, employee reports, law-enforcement tips, or external notifications. After discovery, standard practice includes containment, assessment of what records were touched, and determination of whether notification laws in relevant states require formal notices to residents and regulators. The precise sequence in any single case can vary widely; when a filing does not describe the intrusion method, as here, the public record simply leaves that step undisclosed.

No claim is made that any of these general patterns occurred at Numotion. They are background only, offered so readers understand the ordinary lifecycle of events that produce attorney-general breach notices.

About United Seating and Mobility LLC dba Numotion

United Seating and Mobility LLC operates under the trade name Numotion. Companies in this sector supply complex rehabilitation technology—custom wheelchairs, seating systems, mobility devices, and related clinical and fitting services—to people with disabilities and mobility impairments. Their work routinely involves coordination with clinicians, insurers, and patients, which means they typically maintain records that include personal identifiers, contact information, health-related details necessary for device fitting and billing, and sometimes insurance or payment data.

A breach affecting even a modest number of individuals at such an organization carries weight because the data is often more sensitive than ordinary retail or marketing lists. Mobility and seating providers sit at the intersection of healthcare support and durable medical equipment; the information they hold can reveal medical conditions, living situations, and financial arrangements tied to care. That context explains why state notification statutes treat personal information held by these firms as material when it is exposed.

Nothing in the Indiana filing asserts negligence or assigns fault. The notice simply records that an incident occurred and that a defined set of residents was affected.

The information in question

The breach notification names the exposed data only as “personal information.” No further itemization—such as Social Security numbers, dates of birth, medical record numbers, addresses, or financial account details—appears in the reported summary. Because the exact data elements remain unconfirmed beyond that broad label, it is not possible to state with certainty which specific fields were involved.

Organizations that provide seating and mobility equipment commonly hold, in the ordinary course of business, names, addresses, telephone numbers, dates of birth, insurance identifiers, clinical notes related to device needs, and billing information. Whether any or all of those categories were present in the February 1, 2026 incident is not established by the public filing. Readers should treat the contents as limited to what the notice itself states: personal information affecting 24 people.

What's at stake

For the individuals counted in the notice, the primary risks are the ordinary consequences of personal information leaving controlled custody. Depending on what fields were actually present, those consequences can include unwanted contact, attempts at identity fraud, or social-engineering efforts that reference real personal details. Even when the absolute number of affected people is small—here, 24—the impact on each person is individual and can be lasting if the data is later misused.

For the organization, the stakes include regulatory follow-up, the cost of investigation and notification, potential civil claims, and reputational effects among patients, clinicians, and referral partners who rely on the firm for sensitive equipment and services. Because the filing provides no dollar amounts or remediation details, those organizational consequences remain outside the confirmed public record.

The limited scale reported does not eliminate concern; it simply bounds the known population. People outside the 24 may still wish to verify whether their own information has appeared in other, unrelated breach corpora.

If your data was in this breach

If you believe you are one of the individuals notified, begin by reading any letter or email you received from the company carefully and retaining it. Consider placing a free fraud alert or credit freeze with the major consumer reporting agencies, monitoring account statements and explanation-of-benefits forms for unfamiliar activity, and being cautious of unexpected calls or messages that reference your mobility equipment or medical needs. If a specific type of identifier was listed in your personal notice, take the corresponding protective steps for that identifier.

You can also run a free exposure scan of your email address to check whether that address has already surfaced in other known breach data sets. Doing so does not confirm or deny inclusion in this particular Numotion incident, but it can surface additional exposures that warrant attention. Keep records of any steps you take, and consult official state or federal consumer resources if you encounter clear signs of misuse.

Public information on this matter is drawn solely from the Indiana Attorney General filing dated May 22, 2026, which places the incident on February 1, 2026, and reports 24 people affected with personal information involved. Further technical or forensic detail has not been released in that notice.

AICompiled with AI assistance from public sources and published under our editorial standards.