Vanguard Data Breach Investigation: Edelson Lechtzin LLP Probes Class Action Claims After Reports That Client Social Security Numbers Were Exposed

What Happened

On November 4, 2026, Vanguard reported a security breach in a formal breach notification filed with the Office of the Vermont Attorney General. According to that filing, 94 Vermont residents were affected by a breach of information that included Social Security numbers.

Public reports and a recently filed lawsuit describe a broader incident. According to those accounts, threat actors claimed in mid-October 2026 to have accessed Vanguard's network servers and advertised a database on a dark web forum. A cybersecurity firm has reported that more than 14 million records linked to Vanguard were offered for sale. Vanguard has not publicly confirmed those claims, described the attack vector, or disclosed the total number of individuals affected across all jurisdictions, and the cybersecurity firm that reported the alleged sale has stated that it has not been independently verified.

What Information Was Exposed

The Vermont Attorney General filing identifies Social Security numbers as among the information involved. Public reports and state regulatory filings indicate the compromised records may include:

• Full legal names
• Social Security numbers
• Account records and other sensitive client data maintained within Vanguard's investment networks
• Separately, a cybersecurity firm has reported that the data offered online included SMS verification logs containing timestamps, phone numbers, countries, and mobile carriers.
  

Because Social Security numbers are among the most sensitive categories of personal information, any exposure heightens the risk of identity theft and financial fraud.

Who May Be Affected

The investigation focuses on current and former Vanguard clients - individual and institutional investors - whose personal information Vanguard maintained. According to the lawsuit, Vanguard does not appear to have notified affected individuals, leaving many customers unsure whether their information was involved. Anyone with an active or former investment, brokerage, or retirement account with Vanguard may face an increased risk of identity theft and fraud and is encouraged to come forward.

Your Legal Options

Edelson Lechtzin LLP

Recommended Steps to Protect Yourself

Review your Vanguard account statements and credit reports regularly, and preserve any notice you receive about the breach.

• Place a free fraud alert or credit freeze with Equifax, Experian, and TransUnion, and obtain your free reports at AnnualCreditReport.com.
• Review your bank, card, and investment statements for anything you do not recognize, and report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov.
  

Contact Us for a Free Case Evaluation

Speak confidentially with a data privacy attorney: Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; Phone: 844-696-7492; Email: ...; or click HERE

About Edelson Lechtzin LLP

Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. Beyond data breach litigation, the firm handles class and collective actions involving securities and investment fraud, antitrust violations, ERISA benefit plans, wage theft, and consumer fraud.

Media and Partnership Inquiries: Use the contact information above regarding interviews, co-counsel opportunities, and referral partnerships.

Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions. Prior results do not guarantee a similar outcome.