Delaware North data breach: files copied through an employee's Microsoft account, license numbers exposed

Date	Event	Record
January 27, 2026	Unauthorized actor copies files	NH notice; Indiana report
January 28, 2026	Unusual activity detected in an employee's Microsoft account; account secured	NH notice; consumer letter
May 28, 2026	Review of the files identifies the people involved	NH notice
June 5, 2026	Letters mailed; reports to New Hampshire, Massachusetts, Vermont and Indiana	NH notice; state records

What happened in the Delaware North breach?

The notice that Delaware North's counsel, BakerHostetler, sent to New Hampshire's attorney general says the company detected unusual activity in an employee's Microsoft account on January 28, 2026, secured the account and began an investigation. The investigation found that the day before, an unauthorized actor had taken copies of certain files.

Neither the notice nor the letter says how the actor got into the account, whose files were copied, or whether anyone has claimed them. The pattern, one compromised email or cloud account and files copied from it, is the one the social engineering guide traces in other incidents.

What information was exposed?

Name, and driver's license number or state-issued ID number. That is what the New Hampshire notice and the consumer letter filed in South Carolina both name, and Massachusetts marks only the driver's license category for its report. Vermont records government ID numbers.

State record	Residents	Data marked
Massachusetts OCABR, report 2026-921	1,500	Driver's license number
New Hampshire Attorney General	1,133	Name, driver's license or state ID number
Indiana Attorney General	268	not broken out
Vermont Attorney General	91	Government ID numbers
Four states	2,992

How many people were affected by the Delaware North breach?

The documents give no national total. The four state counts add up to 2,992, a floor. Indiana's record has no total for the notice, only the 268 Indiana residents.

What is Delaware North offering?

Credit and identity monitoring through Kroll at no cost. The New Hampshire notice says the offer is one year. The filed letter leaves the activation deadline as a template field, so a person's own letter states it. Questions go to (844) 959-7082, Monday to Friday, 9:00 a.m. to 6:30 p.m. Eastern Time.

A driver's license number cannot be changed the way a card can be replaced. The credit monitoring guide compares Kroll offers in other letters.

Why did notice take until June?

From the January 28 detection to the June 5 letters is 128 days. The notice says the review that matched the files to people ended on May 28. The notice delay guide shows how long other organizations took.

What the documents leave open

• How the unauthorized actor got into the employee's Microsoft account.
• Whose information the files held: employees, guests or others.
• The total number of people notified.