Millstone Medical Outsourcing breach notice (2026): what the public record confirms

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

Vermont’s Attorney General register lists a Millstone Medical Outsourcing breach report dated September 21, 2026. It records two affected Vermont residents. That small state figure does not establish the incident’s national size.

What the primary register confirms

The row names Social Security numbers, government ID numbers, financial account codes, credit or debit account information and health records as involved categories. It does not tell a reader which fields were in their own record, provide an incident timeline, or identify a monitoring offer.

Vermont no longer publishes third-party consumer-notice PDFs on this register. We have not verified the full Millstone consumer letter for this update, so this summary does not assign an attack method, incident dates or a monitoring duration from secondary reporting. If you received a letter, use that verified letter for your personal data categories and assistance terms.

What to do now

1. Keep your notice. It identifies the data categories that applied to you and any enrollment deadline.
2. Verify the notice through the organization’s official website or a contact number you already trust. Do not use an unexpected message’s links or share passwords or one-time codes.
3. If Social Security or other identity information was involved, consider a free credit freeze with each of the three major U.S. bureaus. A freeze helps restrict new credit; it does not stop transactions on existing accounts.
4. Review bank and card statements. Contact the institution about unfamiliar transactions. If health information was involved, also check insurance statements for unfamiliar claims.
5. Use IdentityTheft.gov if someone is using your identity. Enroll in any monitoring offer through the verified notice’s instructions.

For help interpreting a letter, see a company emailed me about a breach.

What a Delist scan can tell you

A free Delist scan checks personal-data exposure on the sources we cover. It does not inspect this organization’s systems, establish whether your record was involved in this incident, or erase breach dumps. Paid listing-removal work requires separate authorization.

This summary is compiled from public notices and reporting available when this page was last updated. Figures may change as investigations continue. Confirm your own exposure and any assistance offer with the organization named in your notice.

Inclusion is a record of a publicly reported incident, not an allegation of wrongdoing or negligence.

Does the Vermont listing establish the full Millstone incident size?

No. It lists two affected Vermont residents. The register does not establish a national total, incident timeline or assistance terms. This update has not verified the full consumer letter.

Frequently asked questions

What information does the public register name?

It lists Social Security numbers, government ID numbers, financial account codes, credit or debit account information and health records. Your letter should identify which categories applied to you.

Is a specific monitoring duration confirmed here?

No. We have not verified the full consumer letter. Follow your verified notice for eligibility, enrollment instructions and deadlines.