On October 16, 2026, Johnson Investment Counsel filed an official data breach notice with the Vermont Attorney General. Notification letters went out to people whose information was involved. Recipients of that letter can review their options here for free.
The Vermont Attorney General filing confirms the breach notice — not a court case. This tracker shows settlement figures and deadlines solely where a public court record exists. Outcomes are never estimated or promised.
Per the Vermont Attorney General filing, the Johnson Investment Counsel incident compromised these categories of personal information:
The more sensitive the data involved, the stronger the potential claim. Disclosure of these categories is legally recognized harm.
Johnson Investment Counsel operates as an independent, wealth management and investment advisory firm catering to high-net-worth individuals, families, foundations, and institutional clients. Because of the sophisticated financial services they provide—including comprehensive portfolio management, financial planning, trust services, and estate coordination—the firm maintains an extensive repository of highly sensitive personal and financial documentation. Clients entrust Johnson Investment Counsel with intricate details regarding their entire financial ecosystems, making the firm a centralized hub for confidential asset and wealth management data.
In 2026, Johnson Investment Counsel reported a formal data security incident to the Vermont Attorney General's office, prompting widespread concern among affected individuals. Within the wealth management and financial advisory sector, incidents of this nature typically involve sophisticated cyberattacks, such as unauthorized network intrusions, ransomware deployments, or third-party vendor compromises that target legacy systems or cloud environments where client files are stored. Because financial institutions hold such high-value targets for malicious actors, attackers frequently probe defenses to infiltrate databases housing non-public personal information (NPPI).
The breach exposed a wealth of deeply sensitive data categories, each presenting severe, long-term risks to affected clients. Compromised information frequently includes full names, Social Security numbers, dates of birth, financial account numbers, routing numbers, and detailed investment portfolio valuations. When exposed, this combination of financial and identifying data enables bad actors to execute account takeovers, fraudulent wire transfers, unauthorized loans, and complex tax identity theft. The theft of high-net-worth financial dossiers provides cybercriminals with the precise blueprints necessary to impersonate victims across banking institutions and brokerage accounts.
As a financial institution handling sensitive client data, Johnson Investment Counsel was bound by strict regulatory frameworks, most notably the Gramm-Leach-Bliley Act (GLBA) and the Safeguards Rule enforced by the Federal Trade Commission. These legal standards require financial entities to implement rigorous administrative, technical, and physical safeguards to protect non-public personal information from unauthorized access and disclosure. The occurrence of a significant data breach strongly suggests potential failures in maintaining adequate encryption, multi-factor authentication, network monitoring, or vendor risk management, raising serious questions about whether the firm fulfilled its statutory duty of care.
Receiving an official data breach notification letter from Johnson Investment Counsel serves as formal legal acknowledgement that your confidential financial information was compromised as a result of corporate oversights. Under modern class action jurisprudence, the receipt of such a letter provides affected individuals with the legal standing necessary to pursue claims against the institution, and crucially, does not require you to prove that actual financial fraud has already occurred. Our firm is actively investigating potential class action lawsuits on behalf of those affected by the Johnson Investment Counsel breach, operating on a strict contingency fee basis—meaning you pay nothing out of pocket unless we successfully recover compensation on your behalf.
You do not need to show financial loss to be eligible. Courts have treated exposure of personal data as real harm. You likely qualify if any of the statements below describe you:
You received a data breach notification letter from Johnson Investment Counsel
You were a customer, patient, employee, or client of Johnson Investment Counsel
Your personal information was stored in Johnson Investment Counsel's systems
Your Social Security number or driver's license number was exposed
Your financial account, credit card, or banking information was disclosed
You reside in the United States (all 50 states eligible)
That letter is legally required and confirms your data was exposed. It also gives you standing to file a claim.
What your notification letter means & what to do next →Four moves to make now — they protect both your identity and your legal position:
Your Johnson Investment Counsel notification letter is legal evidence. Keep both physical and digital copies somewhere safe — it establishes you were affected and anchors your claim.
Check your Johnson Investment Counsel letter for credit-monitoring enrollment instructions and use them. Free monitoring catches fraud early and documents harm.
Lock down your credit file at Equifax, Experian and TransUnion with a free security freeze — thieves cannot open accounts on a frozen file.
Claims windows close. Our team reviews Johnson Investment Counsel breach cases free of charge and works on contingency — you pay nothing unless we recover for you.
Security Incident
Prior to AG notification
Someone gained unauthorized access to data held in Johnson Investment Counsel's systems.
Reported to Attorney General
October 16, 2026
The Vermont AG received Johnson Investment Counsel's formal data breach disclosure.
Consumer Notification Letters Sent
Within weeks of AG filing
Notification letters are sent by mail to all individuals whose data was involved.
Legal Window — Act Now
Statute of limitations applies
Legal deadlines limit how long you have to act on this breach.
Several forms of recovery may be available to Johnson Investment Counsel letter recipients — the exact mix depends on state law and the data types exposed:
Per-incident statutory damages may be available even without proof of fraud; California's $100–$750 statute is the leading example.
Reimbursement for fraud charges, unauthorized transactions, or expenses you incurred as a direct result of the breach.
Time spent handling breach fallout — freezes, disputes, monitoring — is compensable.
Reimbursement for the cost of credit monitoring services, identity theft protection, and related identity restoration expenses.
SSN and driver's license exposure creates long-term identity theft risk. Courts recognize the ongoing value of this harm and may award damages accordingly.
Exposure of financial account or credit/debit card information entitles victims to recover for actual and potential fraud losses.
Vermont's Security Breach Notice Act requires timely notification to affected residents. Vermont courts have recognized that delayed notification itself can serve as a basis for legal claims.
Other companies have notified the Vermont AG of breaches. Received one of these letters as well? You may have more than one claim.
Murray County
Vermont · Oct 2026
Arkansas Hospice Inc. d/b/a LifeTouch Health
Vermont · Oct 2026
Wayne-Finger Lakes BOCES
Vermont · Oct 2026
Martin, Magnuson, McCarthy & Kenney
Vermont · Oct 2026
zizzl, llc
Vermont · Oct 2026
Sawyer Savings Bank
Vermont · Oct 2026
Contact us for a FREE consultation. No fee unless we win your case.
(786) 306-7278Free Claim ReviewLaw Office of David S. Harris