Doxa E&S Solutions, LLC, a surplus lines insurance brokerage and claims adjusting firm licensed across dozens of states and affiliated with DOXA Insurance Holdings, recently notified the Vermont Attorney General’s Office that a data security incident exposed sensitive personal information belonging to at least one Vermont resident. Insurance brokerage and adjusting firms that collect policyholder identification data have a responsibility to protect that information from unauthorized access.
Doxa E&S Solutions’s Data Breach Investigation
According to a filing with the Vermont Attorney General’s Office, Doxa E&S Solutions reported on July 27, 2026 that a security incident resulted in the exposure of Social Security numbers and government-issued identification numbers belonging to at least one Vermont resident. Doxa E&S Solutions has not publicly disclosed additional details about how the incident occurred, when it was first discovered, or the total number of individuals nationwide who may have been affected beyond the single Vermont resident reflected in the state filing. This notification was made around the same time as related filings involving affiliated Doxa entities, which is not unusual for organizations that share back-office systems and infrastructure across multiple licensed subsidiaries.
Surplus lines brokers and independent claims adjusters routinely handle detailed personal identification information as part of underwriting nonstandard risks and processing insurance claims across many states. Because firms in this space are often licensed and operate nationally through a shared administrative infrastructure, a single compromised system can potentially expose identification data belonging to policyholders and claimants across numerous jurisdictions at once.
Social Security numbers and government-issued identification numbers are considered especially high-risk data types because they can be used directly to open new lines of credit, file fraudulent tax returns, or apply for government benefits in a victim’s name. Unlike a compromised password or account number, these identifiers generally cannot be changed, meaning affected individuals may face an elevated risk of identity theft for years after the initial exposure.
State data breach notification laws, including Vermont’s, generally require companies to report incidents affecting residents within a defined timeframe of discovery, though the specific date of discovery or the underlying cause of an incident are not always included in the initial regulatory filing. As more information becomes available about the scope and cause of the Doxa E&S Solutions breach, this page will be a resource for those seeking to understand their rights.
When Did This Breach Occur?
The exact date the security incident occurred or was first discovered has not been publicly disclosed by Doxa E&S Solutions. The only confirmed date on record is July 27, 2026, when the incident was reported to the Vermont Attorney General’s Office as required under state breach notification law. It is common for the date of discovery and the date of public notification to differ while a company investigates the scope of an incident before notifying regulators and affected individuals.
What Information Was Breached?
Based on the filing with the Vermont Attorney General’s Office, the data exposed in this incident included Social Security numbers and government-issued identification numbers. Doxa E&S Solutions has not disclosed whether any additional categories of personal information, such as names, addresses, or policy details, were also involved. If you receive a notification letter directly from Doxa E&S Solutions, review it carefully, as it may include more specific detail about exactly what information of yours was affected.
What You Can Do
If you believe you may have been affected by the Doxa E&S Solutions data breach, consider taking the following steps to protect yourself:
- Place a fraud alert or credit freeze with the three major credit bureaus, especially important given the reported exposure of Social Security numbers.
- Monitor your credit reports regularly for accounts you did not open.
- Watch for signs of tax identity theft, such as a rejected tax return or unexpected IRS correspondence.
- Be cautious of phishing emails or calls referencing this incident, as scammers sometimes exploit publicized breaches to trick victims into revealing more information.
- Keep any notification letter you receive, as it may be needed to support a legal claim.
File a Data Breach Lawsuit Against Doxa E&S Solutions
If you were notified that your Social Security number or government ID number was compromised in the Doxa E&S Solutions data breach, you may have legal options available to you. Insurance brokerage firms that collect and store sensitive identification data are expected to implement reasonable safeguards to protect it, and when those safeguards fail, affected individuals may be entitled to compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
