Hands On Children's Museum data breach: backup drive stolen from an IT vendor's car

What happened to the Hands On Children's Museum backup drive?

The museum's letter says the drive was taken from an approved IT vendor responsible for its backup systems. It was a vehicle break-in, and the vendor reported it to the police. According to the letter, the thief was not after the drive: it was in a bag with other items taken from the car. The vendor told the museum, which then reviewed the data on the drive to work out what personal information it held and whose. The review finished on November 2, 2026.

When did the breach happen?

The dates in the two records differ by two days. The dates below are copied from the letter and from Washington's record.

Date	What happened	Source
October 6, 2026	Date of breach on Washington's record	Washington AG
On or about October 8, 2026	The museum learns the drive was stolen	Notice letter
November 2, 2026	The museum finishes reviewing the data	Notice letter
November 5, 2026	Letter date and date reported to Washington	Notice letter, Washington AG

Washington's record dates the breach to October 6, 2026, two days before the museum says it learned of the theft. The letter is dated November 5, 2026, the same day Washington's record gives as the date reported. That is four weeks from learning of the theft to the letters. The guide to how long companies take to notify sets that gap against other notices in this log.

What information was on the stolen drive?

The copy of the letter filed with Washington leaves its data list blank. It says only that the information "varied by individual", followed by an empty field where each person's own list goes. Washington's record fills that gap. It lists five kinds of information:

• names
• Social Security numbers
• financial and banking information
• full dates of birth
• "other" information that the record does not describe

The letter rules out credit card numbers. It also says the museum knows of no actual or attempted misuse of the information. The letter does not say whether the drive was encrypted.

How many people were affected?

Washington counts 1,001 of its residents. The letter gives no overall total, and the museum's notice adds that no Rhode Island residents are involved. Washington's list counts Washington residents only; the ranking of breaches affecting Washington residents ranks the largest notices on that list. If people in other states were on the drive, their number is not on any record fetched for this entry.

What is the museum offering people who got the letter?

The offer is single-bureau credit monitoring, a credit report and a credit score at no charge. The alerts run for twelve months from enrolment. The letter also promises fraud assistance and says TransUnion provides the services. Enrolment is at bfs.cyberscout.com/activate with the code printed in the letter, and it has to be done within 90 days of the letter's date. The assistance line is 1-800-405-6108, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern Time. The guide to credit-monitoring offers in breach letters compares this offer with those in other letters.

What the notice leaves open

• The vendor is not named, and the letter does not say whether the drive was encrypted.
• The letter does not say whether the drive has been recovered.
• No total across states is given, so the full number of people on the drive is unknown.
• Washington's record dates the breach two days before the museum says it learned of the theft. The letter does not explain the difference.

The guide to vendor breach notices covers other letters where a third party's lapse reached an organization's own records.