ISCO International, the Schaumburg, Illinois company, has notified individuals of a recent event that may have involved their personal information. Its notice letter is dated November 2, 2026, and a report was filed with the Vermont Attorney General the following day.
Any company that collects Social Security numbers and other personal details takes on a responsibility to protect them, and people who receive a breach notice have a right to know what happened and what they can do next.
ISCO International’s Data Breach Investigation
ISCO International writes in its notice that it is notifying people about a recent event that may have involved their personal information. The company’s letter is dated November 2, 2026, and a sample was filed with the Massachusetts Attorney General’s office, which publishes the letters it receives. ISCO also reported the matter to the Vermont Attorney General on November 3, 2026. Vermont’s public summary classifies the filer as a commercial business and says one Vermont resident was affected.
The letter is brief on the facts. It says ISCO found no evidence that any of the information has been misused, and that the company is giving people information about steps they can take as an added precaution. It does not describe how the event happened, who was behind it, when it started, or when ISCO found out. It also does not give a total number of people affected. The single Vermont resident in the state’s summary is a state-level figure, and Vermont warns that its counts can rise as companies finish their reviews.
ISCO says it has arranged for recipients to enroll, at no cost, in an online credit monitoring service for 24 months, provided by Cyberscout, a TransUnion company. According to the letter, the monitoring includes single-bureau credit monitoring, a single-bureau credit report, and a single-bureau credit score, with alerts sent the same day a change appears on the file, along with fraud assistance if a person becomes a victim of fraud. Because of privacy laws the company cannot sign people up itself, so each person must enroll using the unique code in the letter, and the letter says enrollment must be completed within 90 days of its date.
The letter closes by saying ISCO takes the security of the information entrusted to it very seriously and is taking appropriate action to prevent similar incidents. It lists a dedicated call center that is open Monday through Friday, from 8:00 a.m. to 8:00 p.m. Eastern Time, and a mailing address in Schaumburg, Illinois, for people who want to write to the company.
A notice that says information “may have been involved” can mean very different things. It can describe files that were only viewable by an unauthorized person or files that were copied. In either case, the safest assumption for a person who receives one is that the information could be used, particularly when it includes a Social Security number. Social Security numbers do not change, so they keep their value to identity thieves for years, and monitoring is useful because misuse often surfaces long after a notice is sent.
State breach laws generally require a company to notify affected individuals without unreasonable delay once it knows their information was exposed, and many also require a report to the state attorney general. The filings in Massachusetts and Vermont are consistent with a company completing that process. Until ISCO publishes more, the details of the event remain unconfirmed, and this page does not guess at them.
When Did This Breach Occur?
ISCO International has not said when the event happened or when it discovered it. The dates in the public record are the date of the notice letter, November 2, 2026, and the date the report appears on the Vermont Attorney General’s list, November 3, 2026.
Anyone who received a letter should read it for any additional dates, and keep in mind that credit monitoring enrollment must be completed within 90 days of the date on the letter.
What Information Was Breached?
The Vermont Attorney General’s summary lists one category of information for the ISCO filing: Social Security numbers. The notice letter itself does not list the data elements and says only that the event may have involved the recipient’s personal information.
ISCO has not said whether other details, such as names, addresses, dates of birth, or financial information, were also involved. The letter you receive is the best indication of what was exposed in your case.
What You Can Do
If you received a notice from ISCO International, or you believe you may be affected, consider the following steps.
- Enroll in the 24 months of complimentary credit monitoring through Cyberscout using the unique code in your letter, and do it within 90 days of the letter’s date.
- Review your account statements and credit reports regularly, and report anything you do not recognize to the institution right away.
- Request your free credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com and look for accounts or inquiries you did not authorize.
- Consider placing a free fraud alert or a security freeze with each of the three credit bureaus, keeping in mind that a freeze can delay new credit applications.
- Be cautious with calls, texts, and emails that mention ISCO or the event, especially if they ask you to confirm your Social Security number.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general, and keep your letter and any record of suspicious activity.
File a Data Breach Lawsuit Against ISCO International
People whose personal information is exposed in a data security event may have legal options if the company failed to use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what information was involved, how the event happened, and how the company responded.
If you received a notice from ISCO International, or you believe your information was involved, you can speak with a lawyer about whether you may be able to join a class action lawsuit to seek compensation for the exposure of your information, the time you spent responding, and any losses you suffered.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
