Was I affected by the Barnhart Group, Inc. data breach?
This page summarises what has been publicly reported about this data breach involving Barnhart Group, Inc.. It does not tell you personally whether you were affected — check for an official notification, below, for that.
What is known
What happened, in order
- February 4, 2026Reported to regulator
If you may have been affected
Look for an official notification
- Check the email address and postal address you had on file with this organisation around the disclosure date — genuine notifications are usually sent by post or from the organisation’s own domain, not from a third party.
- Do not click links or call phone numbers inside an unexpected message about this incident; go directly to the organisation’s own website or a contact number you already trust instead.
- Keep any notification letter or email — you may need it later as proof if you have to dispute fraudulent activity.
Consider a credit freeze or fraud alert
- A credit freeze restricts access to your credit file, making it harder for someone to open new credit in your name. Contact all three US credit bureaus — Equifax, Experian and TransUnion — to place one; each must be contacted separately.
- A fraud alert is a lighter-touch alternative that asks lenders to verify your identity before extending credit. It lasts one year and can be renewed.
- Freezes and fraud alerts are free, and a freeze can be lifted or thawed temporarily whenever you need to apply for credit.
Change passwords and enable passkeys
- Change the password for any account you used with this organisation, and for any other account where you reused the same password.
- Use a unique, randomly generated password for each account — a password manager makes this practical.
- Where available, switch to a passkey or turn on multi-factor authentication, preferring an authenticator app over SMS.
Watch for follow-up phishing
- Breach disclosures are often followed by phishing emails, texts or calls impersonating the affected organisation or your bank. Be cautious of any message that creates urgency or asks you to confirm personal details.
- Verify unexpected contact by calling the organisation using a number from its official website, never one supplied in the message itself.
Monitor your accounts and statements
- Review your bank and card statements regularly for transactions you do not recognise.
- Consider setting up transaction alerts with your bank so you are notified of new activity as it happens.
- If you notice unfamiliar accounts or hard inquiries on your credit report, dispute them with the relevant credit bureau or lender.
If a driver’s license number was included
- Contact your state’s Department of Motor Vehicles (or equivalent) to ask whether the number can be flagged or the license reissued.
- A driver’s license number is sometimes used as an identity document for opening accounts — the credit-freeze/fraud-alert step above is the main defence against that.
If a bank account or payment card number was included
- Contact your bank or card provider to ask whether the account or card should be reissued as a precaution.
- Review recent statements for that account or card closely, and set up transaction alerts if you have not already.
- Never provide a full card or account number in response to an unsolicited call, email or text — a genuine bank will not ask for it that way.
If a passport or other government-issued ID number was included
- Check with the issuing agency (e.g. the U.S. State Department for a passport) about whether the document should be monitored or reissued.
- Keep an eye out for any unexpected use of the document number, such as a travel or benefits record you don’t recognise.
If medical information was included
- Review any “Explanation of Benefits” statements from your health insurer for treatment or claims you don’t recognise — this can be a sign of medical identity theft.
- If you spot an unfamiliar claim, contact your insurer and consider requesting a copy of your medical records to check for errors caused by fraudulent use.
If your Social Security number was included
- A Social Security number cannot be changed in most circumstances, so a credit freeze and ongoing monitoring (see above) are the main practical defences rather than replacement.
- Watch for an unexpected IRS notice about a tax return you did not file — this can be a sign of tax-related identity theft. The IRS offers an Identity Protection PIN you can opt into for extra protection.
- Be alert to mail or benefits notices for accounts or claims you did not open.
This is general guidance, not legal advice.