PCH Digital Data Breach Exposes PHI and PII of Adults and Minors

PCH Digital LLC, the company that operates Publishers Clearing House, disclosed a data breach that exposed sensitive personal and health information. The breach took place in February 2026 on what the company described as a legacy computer network.

Between Feb. 4 and 18, 2026, an unauthorized third party gained access to a portion of PCH Digital's legacy computer network. After detecting suspicious activity, the company engaged third-party cybersecurity experts to investigate and address the intrusion.

By April 2026, the investigation confirmed that unauthorized access had occurred during the two-week window.

PCH Digital identified the files that were affected and migrated data to a new environment with stronger safeguards. The company then hired a data-review firm to analyze the contents of the compromised files and received the results in September 2026.

The types of personally identifiable information (PII) exposed included names, contact information, dates of birth, Social Security numbers, other government identification numbers, financial account details such as bank account numbers, credit and debit account information, login credentials and digital signatures.

The breach also exposed protected health information (PHI), including health insurance details and limited medical information such as diagnoses, treatment details and information about medical conditions that individuals had shared with the company.

The company reported the breach to the attorneys general in California and Vermont starting on Nov. 11, 2026, as well as posted a notice of the data breach on its website.

The incident has so far impacted 403 residents of Rhode Island and 298 of Vermont. Written notifications to affected consumers were mailed beginning on Nov. 5, 2026.

PCH Digital's response to the breach

The company is offering affected individuals different levels of identity protection based on what type of information was compromised.

Adults whose Social Security numbers were exposed are being offered a complimentary 12-month membership to TransUnion's credit monitoring and proactive fraud assistance services. Eligible individuals can enroll by visiting mytrueidentity.com and entering the activation code included in their notification letter. Enrollment must be completed by Jan. 28, 2027.

For minors whose government identification numbers, such as Social Security numbers, were exposed, PCH Digital is offering a complimentary 12-month membership to TransUnion's cyber-monitoring services. Parents can enroll by visiting bfs.cyberscout.com/activate using the activation code from their child's notification letter. Enrollment must also be completed by Jan. 28, 2027.

PCH Digital set up a dedicated phone line for affected individuals with questions. Representatives are available between 8 a.m. and 8 p.m. Eastern time, Monday through Friday, excluding holidays. The phone number is included in each person's written notification.