CodeSecure has disclosed a data security incident in which an unauthorized party accessed its systems and viewed or copied personal information. This page summarizes what the company and the Vermont Attorney General have made public so far.
CodeSecure’s Data Breach Investigation
On October 28, 2026, a data security incident involving CodeSecure appeared on the Vermont Attorney General’s list of security breach notices. The listing places the reporting organization in the other commercial category, shows that 3 Vermont residents were affected, and names Social Security numbers, health records and login credentials as the categories of information involved.
CodeSecure has also posted a public notice about the event. According to that notice, the company became aware of suspicious activity within its computer network, moved to secure its systems and brought in third-party forensic specialists to investigate. The investigation concluded that an unauthorized actor accessed the company’s systems on September 15, 2025, and that certain information stored there was viewed or copied by that person. The company then carried out a lengthy review of the affected data to work out what information was involved and who it related to, and it began notifying people once that review was finished.
The notice says CodeSecure mailed letters to potentially affected individuals whose addresses it had on file, and that the letters include an offer of complimentary credit monitoring. It also states that the company has reviewed its policies and procedures and added further cybersecurity measures. CodeSecure says it is not aware of any attempted or actual misuse of the information. The notice adds that CodeSecure has since been integrated into another company, and that the incident affected only CodeSecure systems before that integration.
The figure of 3 covers only Vermont residents. Organizations that notify people in several states often report to each state separately, each with its own count, so the Vermont number should not be read as the total number of people affected. CodeSecure has not published a total, and none is stated here.
Several details remain unknown. The public materials do not explain how the unauthorized actor got into the network, do not say who the actor was, and do not say how many people in total received letters. They also do not say whether any of the information has been published or sold. Anyone who receives a letter should rely on it for the specifics that apply to them, because the company describes the affected information as one or more of a list of categories rather than the same set for every person.
The length of time between the incident and the public filings is also worth noting. The unauthorized access took place on September 15, 2025, while the Vermont listing is dated October 28, 2026. Breach investigations that require a manual review of large volumes of stored files can take many months, because the company has to find the files, identify the people named in them and locate current mailing addresses. State notification laws generally require organizations to notify affected people without unreasonable delay, and whether the timing and content of a given notice meet those standards is the kind of question data breach claims often examine.
A mix of identifiers like the one described here can be especially useful to fraudsters. A Social Security number, a date of birth and a name together can support new-account fraud and tax refund fraud. A passport or driver’s license number can help someone pass identity checks. Health insurance details can be misused for medical identity theft, and a username with its password can open the door to other accounts if the same credentials were reused elsewhere. Unlike a payment card, most of these identifiers cannot simply be canceled and reissued, which is why the risk can last long after the incident.
For people who received a notice, the practical takeaways are simple: read the letter closely, enroll in any monitoring it offers before the enrollment window closes, and watch financial, insurance and online accounts for activity you do not recognize. Details about how the incident developed may emerge as more information is made public, and this page will reflect only what has been confirmed by the company or the state listing.
When Did This Breach Occur?
CodeSecure’s notice states that an unauthorized actor accessed its systems on September 15, 2025. The Vermont Attorney General listing for the incident is dated October 28, 2026. The notice does not give the date the suspicious activity was first noticed or the date the review of affected data finished, so those dates are not known.
What Information Was Breached?
The Vermont listing names Social Security numbers, health records and login credentials. CodeSecure’s own notice says one or more of the following may have been affected for each person: address, date of birth, Social Security number, driver’s license, medical or health insurance information, passport, financial account information, username and password, and name. Not every person is affected in the same way, so your letter is the best guide to what applies to you.
What You Can Do
If you received a notice related to CodeSecure or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the complimentary credit monitoring the letter describes, and change the password on any account that shared the same username and password combination, using a unique password for each one.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against CodeSecure
If you received a notice from CodeSecure, or you believe your Social Security number, health information, passport details or login credentials were involved, you may have legal options for holding the responsible party accountable for how it protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
