Hurricanes Holdings, LLC has filed a data breach notice with the Massachusetts Attorney General. This page explains what the notice says, what it leaves out and what steps people can take.
Organizations that keep personal information have a responsibility to protect it and to tell people clearly when it may have been exposed.
Hurricanes Holdings, LLC’s Data Breach Investigation
Hurricanes Holdings, LLC filed a sample notice letter with the Massachusetts Attorney General’s data breach notification list. The letter tells recipients that a recent incident experienced by the company may have involved some of their personal information. It says the company is unaware of any attempted or actual misuse of information involved in the incident, and that it is sharing information about the incident and steps people can take to protect themselves.
The letter says the personal information contained in the affected files included the recipient’s name along with other data elements. In the copy filed with the state, the part of the letter that lists those elements is an unfilled template field, so the filing does not say which types of information were involved. This page does not guess at what they were.
The same is true of several other details. The date of the letter, the subject line, and the deadline to activate the credit monitoring offer are all left as blank template fields in the filed copy. The letter also does not say what happened, how the company found out, when the incident took place, or how many people were notified. No total has been published, and web searches did not turn up a press release or another state’s filing that fills these gaps.
What the letter does say about the company’s response is that, upon discovery of the incident, it secured its environment, safely restored its systems and operations, and put additional security measures in place. It also says it is notifying people so they can take further steps to protect their information if they feel that is appropriate. The return address on the letter is in Raleigh, North Carolina.
The company is offering 24 months of complimentary credit monitoring and identity restoration services through Kroll. The letter says a credit card is not required to enroll, and that the services include credit monitoring with alerts, unlimited consultation with fraud specialists, and identity restoration help if identity theft occurs. Recipients are told to enroll using the membership number printed on their own letter before the activation deadline stated there.
Beyond the enrollment details, the letter encourages people to stay alert for identity theft and fraud and to monitor their credit reports for suspicious activity. It points to free annual credit reports, initial fraud alerts, credit freezes, and the Federal Trade Commission as resources.
A notice that names a person and leaves the rest of the data types unstated can still matter. A name combined with other identifiers is what criminals use to build convincing phishing messages or to try to open accounts. Recipients should read their own letter closely, because the filed copy cannot show what applies to any one person.
Federal and state laws require organizations to safeguard personal information and to notify people when it may have been exposed. Attorneys reviewing incidents like this one look at how the information was protected, how promptly people were notified, and whether affected people may have legal options. This page relies only on the filed notice and may be updated as more information becomes available.
When Did This Breach Occur?
The filed copy of the notice does not say when the incident occurred, when the company discovered it or when letters were mailed. Those dates are not publicly available at this time.
What Information Was Breached?
The notice says the affected files included recipients’ names along with other data elements. The list of those elements is an unfilled template field in the copy filed with the state, so the specific types of information involved have not been publicly disclosed. If you receive a notice, check it for the types of information named in your case.
What You Can Do
If you received a notice related to Hurricanes Holdings, LLC or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of Kroll credit monitoring and identity restoration the company is offering, using the membership number and activation deadline printed on your letter.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Hurricanes Holdings, LLC
If you received a notice from Hurricanes Holdings, LLC, or you believe your personal information was exposed in this incident, you may have legal options. Whether you can seek compensation depends on the facts, and an attorney can explain whether you may be able to join a class action lawsuit over the exposure of your personal information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
