dbHMS, a Chicago-based building systems engineering firm that operates under the legal name Nest Builders, Inc., recently notified certain individuals that their personal information may have been exposed in a data privacy incident. Notification letters were sent starting on or around August 5, 2026, and the company is offering complimentary credit monitoring through Equifax to those affected.
Any organization that maintains personal and medical information about individuals, whether employees, clients, or other parties, takes on a responsibility to protect that data from unauthorized access. When a breach occurs, the people whose sensitive information is exposed can face lasting consequences.
dbHMS’s Data Breach Investigation
According to a notification letter filed with the Massachusetts Attorney General’s Office, Nest Builders, Inc., doing business as dbHMS, discovered a cybersecurity incident that resulted in unauthorized access to certain personal information. The letter identifies the categories of information involved but does not detail how the incident occurred, the date it was first discovered, or the total number of individuals affected nationwide. dbHMS is offering complimentary credit monitoring services through Equifax to those impacted, along with guidance on placing fraud alerts and credit freezes.
dbHMS describes itself as an engineering firm specializing in mechanical, electrical, plumbing, and technology systems for commercial and institutional buildings, and has worked on contracts with public agencies and large institutional clients. Firms in the architecture, engineering, and construction sector often maintain sensitive records tied to employees, contractors, and the institutions they serve, including personnel files that can contain Social Security numbers and government-issued identification. This makes professional services and engineering firms an increasingly common target for cybercriminals seeking valuable personal data that may not be as heavily fortified as data held by large financial institutions.
State data breach notification laws, including Massachusetts’s, generally require a company to notify affected residents once it determines personal information was accessed without authorization. The process of confirming which specific individuals were affected, verifying mailing addresses, and coordinating notification and credit monitoring vendors can take considerable time after an incident is first detected, which is part of why notification letters are often issued months after an underlying incident actually occurred.
The combination of Social Security numbers, driver’s license numbers, passport information, and medical information exposed in this incident is particularly sensitive, since it can enable identity thieves to open new financial accounts, file fraudulent tax returns, or even attempt medical identity theft in an affected person’s name. Because stolen data of this kind is frequently bought, sold, and used gradually rather than immediately, security experts recommend that affected individuals remain vigilant well beyond any complimentary monitoring period.
Anyone who receives a notification letter from dbHMS, or who believes they may have been affected but has not yet received formal notice, is encouraged to take the protective steps outlined below and speak with a qualified attorney about their legal options.
When Did This Breach Occur?
dbHMS’s notification letters to affected individuals are dated on or around August 5, 2026. The letter does not publicly disclose the specific date the underlying incident occurred or was first discovered. This page will be updated if additional details become publicly available.
What Information Was Breached?
According to the notification letter, the information involved may have included an affected individual’s name in combination with a Social Security number, driver’s license number, state-issued identification card number, passport information, other government-issued identification, and medical information.
What You Can Do
If you received a notification letter from dbHMS, consider taking the following steps to help protect yourself:
- Enroll in the complimentary credit monitoring services referenced in your notification letter within the specified enrollment window.
- Regularly review your bank, credit card, and insurance statements for unfamiliar activity.
- Request a free copy of your credit report from each of the three major credit bureaus at annualcreditreport.com.
- Consider placing a fraud alert or credit freeze on your credit file with Equifax, Experian, and TransUnion.
- Watch for signs of medical identity theft, such as unfamiliar bills or insurance claims, given that medical information was involved.
- Report any signs of identity theft to your local police department and the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against dbHMS
If you received a notice that your personal information may have been compromised in the dbHMS data breach, you may have legal options available to you. Companies that collect sensitive personal and medical information are expected to implement reasonable safeguards to protect it, and affected individuals may be entitled to compensation for the risks they now face.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
