Publishers Clearing House (PCH Digital) data breach letter: legacy network accessed February 4 to 18, 2026

Date	Event
February 4 to 18, 2026	Unauthorized access to part of the network
February 18, 2026	PCH Digital detects suspicious activity in a legacy network
April 2026	The investigation fixes the access window
September 2026	Data-review results received
November 5, 2026	Letters dated
November 11, 2026	Notice posted in California; Vermont records 298 residents

What happened in the Publishers Clearing House data breach?

PCH Digital says it detected suspicious activity on February 18, 2026 in a portion of a legacy computer network, and began investigating and remediating with outside cybersecurity experts. It identified the affected files and moved data to a new environment with increased safeguards. It then had a data-review firm go through the files' contents. Law enforcement was notified, and the letter says that did not delay the notice. The letter does not say how the intruder got in, whether files were copied, or which PCH services the legacy network supported.

What information was exposed in the PCH breach?

That depends on the version of the letter:

Version	Information listed
Identity data	Name, contact information, government identification number (such as a Social Security number)
Medical data	Name, contact information, limited medical information (diagnoses, treatment details or conditions the person chose to share)

Vermont's record is broader. It lists Social Security numbers, financial account codes, credit and debit account information, government ID numbers, health records and login credentials for its 298 residents. The letters filed in California do not name financial account data or login credentials. Recipients should go by the list on their own letter. The guide to reading a California AG breach notice explains how a filed template compares with the letter you receive.

Why did the PCH letter take nine months?

The access ended on February 18, 2026, and the letters are dated November 5, 260 days later. The letter gives the steps in between. The investigation fixed the access window in April. The data-review results arrived in September, and PCH says it then worked to get accurate contact details for the people affected. The notice-delay guide compares that gap with other notices in the log.

Is the PCH breach letter real?

The filed letter comes from "PCH Digital, LLC c/o Cyberscout" at P.O. Box 3826, Suwanee, GA 30024. Enrollment in the monitoring offer runs through TransUnion's site, mytrueidentity.com. The letter does not ask for payment, and it does not say you have won a prize. A message that does either is not this notice.

What is PCH offering people who got the letter?

A 12-month membership in TransUnion's credit monitoring and proactive fraud assistance at no cost. The enrollment deadline is January 28, 2027. The help line is open 8:00 a.m. to 8:00 p.m. Eastern, Monday through Friday, and its number is printed on each letter. Credit monitoring offers in breach letters compares offers across the log.