PCH Digital, LLC, the company named in the terms of service for the PCH.com sweepstakes website, has reported a data breach to a state regulator. This page explains what the public filing says, what has not been disclosed and what users and others can do now.
The details below come from a state attorney general listing and may change as the company releases more information.
PCH Digital’s Data Breach Investigation
PCH Digital, LLC is the entity named in the terms of service for PCH.com, a website that offers sweepstakes, games and promotions to online users. The terms list a Miami, Florida address for notices to the company. Online promotion businesses collect account details, contact information and, in some cases, payment or identity information from the people who enter and win prizes.
The breach became public through the Vermont Attorney General’s security breach notice listing. The entry for PCH Digital, LLC is dated November 11, 2026, the date the breach was reported to the attorney general’s office. The listing classifies the company as an other commercial organization and states that 298 Vermont residents were affected.
That count is more significant than many entries in the same listing, because Vermont is a small state. A figure of 298 residents from one small state suggests that the nationwide total could be substantially larger. Even so, the total has not been published, and this page does not offer an estimate. Each state reports its own residents, and the companies involved may have filed separate reports with other regulators.
The listing names six categories of information: Social Security numbers, financial account codes, credit and debit account information, government ID numbers, health records and login credentials. That is an unusually broad group for an online sweepstakes business. Identity numbers, payment details and credentials each create their own risks, and when they are exposed together they make it far easier to commit fraud or take over accounts.
The listing does not say which categories apply to which person. It does not explain why the information was held, and it does not say whether the people involved were website users, prize winners, employees, contractors or others. Prize winners are often asked for identity numbers for tax reporting, and payment details may be collected for prize delivery or purchases, but the listing does not say that any of this applies here, and it should not be assumed.
Equally important is what the filing leaves out. It does not describe how the incident happened, when it began, when it was discovered or whether an outside party copied any information. It does not say whether the exposed login credentials were for the company’s own site or for other services. Until PCH Digital provides its own account of the incident, the cause remains unknown.
Login credentials in particular call for quick action. Many people reuse a password across several sites, so a credential stolen from one service can be tried against email, banking and shopping accounts elsewhere. Anyone who has an account with the site should change the password there and on any other account that uses the same one, and should turn on multi-factor authentication wherever it is offered.
Sweepstakes and promotion websites are also a common backdrop for scams. People who enter contests share contact details with a company in hopes of winning, and criminals sometimes contact them claiming that a prize requires a fee or more personal information. After any breach, treat unexpected messages about prizes, accounts or refunds with caution, and do not click links or call numbers provided in a message you did not expect.
State breach laws require companies to notify the people affected, and each state sets its own rules for timing and content. If you receive a written notice from PCH Digital, keep it, since it is the best record of what the company says was involved and what protection it is offering. If you think you may be affected but have not received a letter, you can begin the protective steps below while more details come out.
When Did This Breach Occur?
The listing gives November 11, 2026 as the date the breach was reported to the Vermont Attorney General. It does not provide the date the incident occurred, the date it was discovered or the date notices were sent to affected people. Those dates have not been made public. If PCH Digital or another regulator publishes a fuller notice, compare its timeline with the date on any letter you received.
What Information Was Breached?
According to the Vermont listing, the information involved included Social Security numbers, financial account codes, credit and debit account information, government ID numbers, health records and login credentials. The listing does not say whether each person had every category exposed. Read your own notice closely to see which items apply to you, and treat identity numbers, payment details and passwords as needing immediate protection if they appear in it.
What You Can Do
If you received a notice related to PCH Digital or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Because login credentials are among the categories listed, change your password for any account with the company and for any other account that shares it, and turn on multi-factor authentication.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against PCH Digital
Attorneys are looking into the data breach reported by PCH Digital and want to hear from people who received a notice. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the company ultimately confirms about the incident. If you received a notice or believe your information was exposed, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
