Businesses, organizations and government agencies have a duty to protect consumer information. Vermont law says that personal and financial information must be kept confidential and secure. The law also says that consumers need to be told when there has been a “data breach.”

A data breach is when information such as your name, social security number or bank account has been accessed by people that were not authorized to see it. Sometimes people say a business or organization has been “hacked” or had a “data leak.”

When there is a data breach, businesses and organizations have to tell the Office of the Attorney General within 14 days. If your information was taken along with the information of a lot of other people, you will get notice of the breach through the media. If it was a smaller breach, you should get notified as soon as possible and no later than 45 days after they discover the breach.

When thieves get their hands on consumer information, sometimes they use it steal from the customers. Sometimes they make purchases with their credit cards or open new accounts. See our information on identity theft. Sometimes this can happen right away and sometimes it can happen long after the breach.

It’s important to always keep an eye on your bank accounts, credit reports and credit card statements. Look for activity that you don’t recognize. Report suspicious activity right away. Also consider filing your taxes as soon as possible so you can beat any thief who may try to do so using your information.

Learn More

• Visit this web page on the Vermont Attorney General’s website for information about recent data breaches. 
• If you are worried that someone is using your personal information to commit identity theft, visit our Identity Theft web page. It includes steps you can take to stop the damage from identity theft and repair your credit.