Cirrus

Disclosed Nov 9, 20263,903 affectedConfirmed

What is known

People affected	3,903 (as reported by the organization)
Disclosed	Nov 9, 2026
Discovered	Jul 20, 2026
Attack	Not stated
Data exposed	Social Security numbersGovernment IDsHealthPayment cardsFinancialAddressesNamesPasswords
Sector	Retail · US
Status	Confirmed

Sources

Official noticeago.vermont.gov

Vermont Attorney General breach report: Cirrus

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005507: Cirrus

Notices filed

Residents of VTNov 9

Vermont AG4 people

Residents of TXNov 10

Texas AG280 people

History of this record

data_types2026-11-11

["ssn","government-id","health","payment-card","financial","addresses","names"] to ["ssn","government-id","health","payment-card","financial","addresses","names","passwords"]by dailySource

disclosed2026-11-11

2026-11-10 to 2026-11-09by dailySource

Added2026-11-11

First recordedby dailySource

First seen 2026-11-11 (Texas AG), confirmed by Texas AG. Record counts are as reported. Not legal advice.

Everything about Cirrus