Lincoln National Life Insurance Company, part of the Lincoln Financial Group family of companies, has disclosed a data breach affecting an undisclosed number of individuals across the United States. The incident exposed sensitive personal and health information, and the company has begun notifying affected consumers directly. Financial services and insurance companies are entrusted with vast amounts of sensitive personal data, and they carry a legal responsibility to keep that information secure from unauthorized access.
Lincoln National’s Data Breach Investigation
Lincoln National Life Insurance Company disclosed the breach to the Massachusetts Office of Consumer Affairs and Business Regulation on September 1, 2026, and began mailing notification letters to affected individuals on August 27, 2026. According to the notification, the company recently discovered that personal information it held had been subject to unauthorized access. The letter did not specify when the unauthorized access itself occurred or when the company first detected it internally, stating only that the discovery was recent relative to the notification date.
The types of information involved in the breach included Social Security numbers and medical records, both of which are among the most sensitive categories of personal data a company can hold. Lincoln National also filed notice of the incident with attorneys general and regulators in numerous other states, including California, Iowa, Maine, Montana, Nebraska, New Hampshire, Oregon, Rhode Island, South Carolina, Texas, Vermont, and Washington, along with the U.S. Department of Health and Human Services and the U.S. Securities and Exchange Commission, reflecting the broad, multi-state footprint of Lincoln Financial’s customer base. As of this writing, the exact total number of individuals affected nationwide has not been publicly disclosed.
Insurance and financial services companies have become an increasingly common target for cybercriminals because of the sheer volume and sensitivity of the records they maintain, from Social Security numbers and financial account details to, in this case, medical records tied to insurance and annuity products. When Social Security numbers and medical information are exposed together, affected individuals face an elevated risk not just of routine identity theft, but of more specialized fraud such as fraudulent insurance claims, unauthorized medical billing, or attempts to open new lines of credit using a combination of financial and health-related identifiers. Medical identity theft in particular can be more difficult to detect and unwind than standard financial fraud, since fraudulent claims can affect a victim’s own medical records and insurance coverage in ways that are not always caught by routine credit monitoring alone.
The gap between when a breach is first discovered internally and when it is ultimately disclosed to consumers is a recurring point of scrutiny in data breach litigation generally. Regulators in many states require notification without unreasonable delay, but companies are also permitted reasonable time to investigate the scope of an incident before notifying the public, which can create a lag of weeks or months between discovery and disclosure. Because Lincoln National’s notification letter did not specify a discovery date, it is not yet clear how much time passed between the unauthorized access and the company’s decision to notify affected individuals and regulators, though the fact that notification did not begin until late August 2026 suggests some investigation period preceded the public disclosure.
In response to the breach, Lincoln National is offering affected individuals a complimentary two-year membership in Experian’s IdentityWorks credit monitoring service, with enrollment codes included in the notification letters valid for 60 days from the August 27, 2026 letter date. While credit monitoring can help detect certain kinds of fraudulent activity after the fact, it does not undo the underlying exposure of Social Security numbers and medical records, nor does it fully address risks specific to medical identity theft. Affected individuals who want a fuller picture of their legal options, including the possibility of joining others impacted by the same incident, may want to speak with an attorney who focuses on data breach litigation.
Beyond the immediate risk of fraud, breaches involving both Social Security numbers and medical records can have longer-lasting consequences than a typical financial-data-only incident. A Social Security number cannot be changed the way a compromised credit card number can be reissued, which means the exposure carries a lasting risk that extends well beyond any single credit monitoring subscription. Combined with medical information, the exposure also raises privacy concerns distinct from ordinary identity theft, since health-related data can reveal sensitive details about a person’s medical history that they never intended to make public. For these reasons, affected individuals are encouraged to remain vigilant well beyond the two-year window covered by the offered credit monitoring service, and to consider consulting an attorney about their options if they experience any suspicious activity tied to either their financial accounts or their medical records going forward.
When Did This Breach Occur?
The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on September 1, 2026, and Lincoln National began mailing notification letters to affected consumers on August 27, 2026. The notification letter did not specify the date on which the unauthorized access itself occurred or when Lincoln National first detected it internally.
What Information Was Breached?
The breach exposed Social Security numbers and medical records belonging to an undisclosed number of individuals. Lincoln National’s notification did not provide a full, itemized breakdown of every data element involved beyond confirming that these two categories of sensitive information were affected.
What You Can Do
Enroll in credit monitoring using the code provided in your notification letter to activate the complimentary two-year Experian IdentityWorks membership within 60 days of the letter date. Review your credit reports at AnnualCreditReport.com and watch for unfamiliar accounts or inquiries. Keep an eye on your insurance and medical records by requesting an explanation of benefits or itemized statement periodically and looking for unfamiliar claims or treatments. Consider placing a credit freeze with each credit bureau to make it harder for identity thieves to open new accounts in your name. If you received a notification letter, speak with an attorney, as you may be entitled to compensation for the exposure of your sensitive information.
File a Data Breach Lawsuit Against Lincoln National
If you received a data breach notification letter from Lincoln National Life Insurance Company, you may be entitled to compensation for the exposure of your Social Security number and medical records, even if you have not yet experienced direct financial harm. Companies that manage sensitive personal and health information are legally obligated to protect it, and when that trust is broken, affected individuals have the right to hold the company accountable.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
