WM, the waste collection and environmental services company whose legal name is USA Waste-Management Resources, LLC, has begun notifying people that their personal information, including Social Security numbers, may have been exposed after an unauthorized party used social engineering to reach part of its information systems.
WM’s Data Breach Investigation
WM reports that it discovered the problem on September 2, 2026. According to the company’s notices and the state filings that summarize them, an unauthorized party used social engineering tactics to access data from a portion of WM’s information systems. Social engineering means tricking a person, rather than breaking a technical control, for example by posing as a trusted colleague, vendor, or help desk contact in order to obtain credentials or access. The company says the unauthorized access took place between June 17, 2026 and September 3, 2026.
After discovering the issue, WM says it took steps to secure its systems and launched an investigation with the help of outside legal counsel and a third-party forensics team. That investigation was meant to determine what the unauthorized party did and which information was involved. On October 6, 2026, WM completed its assessment and determined that the personal information of certain individuals may have been affected. The company began notifying affected people on November 6, 2026.
The breach has been reported to several state regulators, and the figures published so far are broken out by state rather than given as a single national total. The filings show 6,875 Texas residents, 1,402 Massachusetts residents, and 1,292 South Carolina residents affected, and a report to Vermont lists six Vermont residents. The incident was also reported to the California Attorney General. Because notices were also filed in other states without a posted count we could verify, and because WM has not announced a company-wide figure, the true total may be higher than the sum of these state numbers, and we are not adding them together or estimating one.
Multi-state filings with separate per-state figures are a normal part of the regulatory process. Each state sets its own notification rules, and companies usually report to a state only the number of that state’s residents affected. A different figure in each state’s filing is therefore not an inconsistency. It is a reflection of how the data is collected.
A feature of this incident worth noting is the length of the access window. The access ran from June 17, 2026 to September 3, 2026, which means the unauthorized party had a period of weeks in which to view or copy information before WM discovered the activity and acted. Social engineering incidents often work this way: once an attacker holds a legitimate-looking set of credentials or a trusted session, their activity can blend in with normal use and go unnoticed until something unusual triggers an alert. The company has not said how the activity was detected or whether any data was published online.
WM is a large, well-known company that serves residential, commercial, industrial, and municipal customers, which means it holds information about many categories of people, including employees, former employees, and individuals connected to its business. The notices we have seen do not say whether the affected people are workers, customers, or others, and we are not assuming any group. If you received a letter, it should state how WM holds your information.
As part of its response, WM is offering affected individuals 24 months of complimentary credit monitoring and identity protection through Cyberscout, a TransUnion company. Enrollment requires the unique activation code printed in the notification letter and must be completed within 90 days of the date of that letter. The company also set up a dedicated phone line for questions, available on weekdays during business hours Eastern time.
WM has not published how the unauthorized party was identified, whether the incident involved extortion, or whether the stolen data has been used. Until more is disclosed, the safest approach for anyone who got a letter is to treat the exposure of a Social Security number as serious and to act on the protective steps below. We will update this page if WM or a regulator publishes further details.
When Did This Breach Occur?
WM states that the unauthorized access occurred between June 17, 2026 and September 3, 2026, and that it discovered the issue on September 2, 2026. The company completed its assessment of which information was involved on October 6, 2026.
WM began notifying affected consumers on November 6, 2026. Enrollment in the free credit monitoring must be completed within 90 days of the date on the individual’s letter, so keep the letter and check the date printed on it.
What Information Was Breached?
WM’s notices state that the type of information exposed included Social Security numbers. Public aggregator summaries of the filings list other categories, such as names, dates of birth, addresses, government IDs, medical information, and financial information, but those same summaries mark the affected information types as not yet disclosed, so we are not treating those categories as confirmed.
What is clear is that a Social Security number is among the data involved. A Social Security number is a durable identifier that can be used to open accounts or file false tax returns, which is why the steps below matter even if no misuse has been reported. Your own letter is the best guide to what was involved in your case.
What You Can Do
Enroll in the free credit monitoring and identity protection that WM is offering, using the unique activation code in your letter. Do not wait: enrollment must be completed within 90 days of the date of the letter.
Review your financial accounts, benefit statements, and credit reports regularly for activity you do not recognize. You are entitled to a free credit report from each of the three nationwide credit bureaus on a recurring basis through annualcreditreport.com.
Consider placing a fraud alert or a free security freeze on your credit files with Equifax, Experian, and TransUnion. A freeze stops new credit from being opened using your information until you lift it.
Be cautious about unexpected calls, emails, and texts that mention WM or ask for personal details. Because this incident began with social engineering, follow-up scams that use the breach as a pretext are a real possibility. If you suspect identity theft, report it to the Federal Trade Commission at ftc.gov/idtheft and to local law enforcement.
File a Data Breach Lawsuit Against WM
When a company’s systems are accessed and Social Security numbers may have been exposed, affected people sometimes have legal options, including joining a class action to seek compensation for the time, risk, and costs the exposure creates. Whether a particular claim is viable depends on facts that continue to come to light, including how the unauthorized party gained access and how many people are affected.
Class Action U can connect you with a lawyer who handles data breach cases. Speaking with a lawyer does not commit you to anything.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
