Almeida Law Group is investigating a data breach at White River Junction VA Medical Center. If you were affected, contact Almeida Law Group.
About White River Junction VA Medical Center
White River Junction VA Medical Center is a U.S. Department of Veterans Affairs acute care facility located on a 64-acre campus in the Upper Connecticut River Valley, at 163 Veterans Drive, White River Junction, VT 05001. It provides healthcare services to eligible veterans in Vermont and four contiguous counties of New Hampshire through seven outpatient clinics across those regions. The facility is affiliated with the Geisel School of Medicine and the University of Vermont College of Medicine. Because it serves veterans and delivers healthcare, it handles both personal identifying information and individually identifiable health information, making any unauthorized disclosure of that data a serious concern for affected veterans.
What Happened?
White River Junction VA Medical Center was listed in an HHS Office for Civil Rights breach portal report filed on August 28th, 2026. The incident was classified as an unauthorized access/disclosure involving email.
According to a VA official press release, the breach involved several unencrypted email communications sent between June 2026 and July 2026 that contained veterans’ Personally Identifiable Information (PII) and Individually Identifiable Health Information. The VA characterized the incident as unintentional and stated there is currently no indication that any data has been compromised. The VA is sending notification letters to all 1,408 affected individuals. No cyberattack or ransomware was involved.
This facility has a documented history of smaller privacy incidents. ProPublica’s HIPAA database records prior incidents including a May 2011 incident in which PHI and PII belonging to seven veterans was taken outside VA control by a staff member’s spouse, an April 2011 incident involving misdirected medical records, a March 2012 incident in which an appointment letter containing a veteran’s full name, address, date of birth, and Social Security number was sent to the wrong veteran, and a February 2013 incident in which nursing medication lists containing full Social Security numbers were inadvertently included in a veteran’s discharge paperwork. No class action lawsuits or public litigation connected to this specific August 2026 breach have been found.
Key Facts at a Glance
- Company or Organization: White River Junction VA Medical Center
- Industry: Healthcare Provider (Federal – U.S. Department of Veterans Affairs)
- Location: 163 Veterans Drive, White River Junction, VT 05001
- Incident type: Unauthorized Access/Disclosure (unintentional unencrypted email communications)
- Date of breach: June 2026 – July 2026
- Date breach discovered: August 28th, 2026
- Total persons affected: 1,408
- Prior breach: Yes – multiple smaller privacy incidents documented at this facility (2011–2013)
- Litigation status: No class action or public litigation found connected to this incident
- Source: HHS OCR Breach Portal; VA Official Press Release; WCAX News
What Should You Do?
If you received a notification letter from the VA, review it carefully for any identity protection enrollment offer and note any enrollment deadline. Even if no monitoring service is offered, you should place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—and monitor your credit reports for unfamiliar activity at AnnualCreditReport.com. If you believe your identity has been misused, visit IdentityTheft.gov for step-by-step recovery guidance. Because health information was involved, also review any Explanation of Benefits statements from your health insurer or the VA and check your medical records for services you did not receive, which could indicate fraudulent use of your healthcare information.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
