Data Breach & Privacy
Blog > Data Breach & Privacy
LeMaitre Vascular Data Breach: What Affected Individuals Need to Know
LeMaitre Vascular, a Burlington, Massachusetts medical device company, notified individuals in September 2026 of a data security incident that state filings indicate may have involved Social Security numbers, government ID numbers, and health records. Here is what the company disclosed and what affected individuals can consider doing.
What Happened in the LeMaitre Vascular Data Breach
A data security incident disclosed in September 2026
According to a notification letter LeMaitre Vascular, Inc. filed with the Massachusetts Attorney General, the company states that it recently experienced a data security incident that may have affected recipients’ personal information. The letter is dated September 18, 2026, and the incident was also reported to the Vermont Attorney General on the same date.
The company’s letter does not state when the incident occurred, when it was discovered, or how it happened, and LeMaitre has not published a separate public statement describing the event. LeMaitre states that it has no evidence of the misuse or attempted misuse of any potentially impacted information. As with many incidents of this kind, details reported at this stage may be refined as additional filings become public.
Who May Be Affected by the LeMaitre Vascular Breach
Individuals whose information the company maintained
LeMaitre Vascular develops and sells medical devices for the treatment of peripheral vascular disease and is headquartered at 63 Second Avenue in Burlington, Massachusetts. The company’s letter does not specify whether the affected individuals are employees, customers, patients, or others whose information it held, and it has not published a total number of affected individuals.
State filings indicate a multi-state notification: reporting on the company’s filing with the Massachusetts Office of Consumer Affairs and Business Regulation indicates roughly 955 Massachusetts residents were affected, and the Vermont Attorney General lists two Vermont residents. As of this writing, the incident does not appear on the U.S. Department of Health and Human Services breach portal. If you received a letter from LeMaitre Vascular referencing this incident or a Cyberscout enrollment code, that notice may indicate your information was among the data reported to have been affected.
How LeMaitre Vascular Responded and What Protections Are Offered
Twenty-four months of TransUnion identity protection through Cyberscout
LeMaitre states that it takes the privacy and security of information in its possession seriously and that, out of an abundance of caution, it is offering affected individuals 24 months of complimentary identity protection services through TransUnion. The letter describes these services as including 24 months of credit and dark web monitoring, a $1 million identity fraud loss reimbursement policy, and fully managed identity theft recovery services.
Individuals must enroll themselves using the enrollment code in their letter, and the deadline to enroll is December 18, 2026.
Steps You Can Take to Protect Yourself
Practical precautions while the situation is reviewed
Given the categories of information reported in state filings, affected individuals may wish to consider a few precautionary steps:
- Enroll in the TransUnion identity protection offer. If your letter includes an enrollment code, consider enrolling before the December 18, 2026 deadline.
- Consider a credit freeze or fraud alert. Both are free through Equifax, Experian, and TransUnion; Massachusetts residents also have a statutory right to a security freeze noted in the letter.
- Monitor Explanation of Benefits statements. Because health records may be involved, watch for medical claims or services you did not receive.
- Review your credit reports. You are entitled to free credit reports at annualcreditreport.com.
- Stay alert to phishing. Be cautious of unexpected emails, calls, or texts referencing LeMaitre or the incident, and verify any outreach independently before responding.
This information is a general overview and is not legal advice; your situation may differ, and consulting a legal professional can help you understand rights that may apply to you.
Talk to Wilshire Law Firm
Were you affected by the LeMaitre Vascular data breach?
If your personal or health information may have been involved in the LeMaitre Vascular data breach, do you know what your options are? Our nationally recognized, award-winning team is here to help you understand your rights. Wilshire Law Firm offers free consultations and free case reviews with a legal professional, and we are available 24/7. Because we work on a contingency basis, there are no fees unless you get paid.
Contact Wilshire Law Firm today to schedule your free case review and get your questions answered.
FAQs
LeMaitre’s notification letter is dated September 18, 2026, and the incident was reported to the Vermont Attorney General the same day. The letter describes the event as a recent data security incident but does not give the date it occurred or was discovered.
The company’s letter does not describe how the incident occurred, and LeMaitre has not published a separate public statement explaining the cause.
The Massachusetts letter does not itemize the data. The Vermont Attorney General’s listing for the incident identifies Social Security numbers, government identification numbers, and health records as the categories involved.
LeMaitre has not published a total. Reporting on the Massachusetts filing indicates roughly 955 Massachusetts residents were affected, and the Vermont Attorney General lists two Vermont residents. The incident does not currently appear on the federal HHS breach portal.
Yes. The company reports it is offering 24 months of identity protection through TransUnion, including credit and dark web monitoring, a $1 million identity fraud loss reimbursement policy, and managed identity theft recovery. Individuals must enroll with the code in their letter by December 18, 2026.
Consider enrolling in the TransUnion offer before the deadline, placing a credit freeze or fraud alert, reviewing your credit reports and Explanation of Benefits statements, staying alert to phishing, and keeping your notice. You may also wish to speak with a legal professional about any rights or options that may apply to your situation.
Individuals who believe they were affected may have legal options, and data breaches involving Social Security numbers and health information can sometimes lead to class action litigation. Whether a claim may apply to you depends on the specific facts. A free case review with a legal professional can help you understand your potential rights.
Start Your Free Case Review
- Available 24/7
- Hablamos Español
- Nationally-Recognized Powerhouse Team
As seen in:
We'll contact you within minutes
No fees unless you get paid.
What Information May Have Been Involved
Social Security numbers, government IDs, and health records per state filings
The Massachusetts version of LeMaitre’s letter does not itemize the categories of information involved. The Vermont Attorney General’s public listing for the same incident identifies the affected data as Social Security numbers, government identification numbers, and health records.
Because a Social Security number combined with a government ID and health information can be used for both financial and medical identity theft, affected individuals may face an elevated risk even though the company reports no evidence of misuse. Individual letters may describe the specific information that applied to each recipient.