WM data breach: social engineering exposed Social Security numbers, June to September 2026

What happened at WM?

WM became aware of a possible problem in a limited part of its systems on September 2, 2026. With counsel and an outside forensics team, it found that the access had begun two and a half months earlier, on June 17, and ran until September 3, the day after WM noticed. The letter calls the method "sophisticated social engineering" without saying who was deceived, or whether it was a phone call, an email or a help-desk request. On October 6, 2026, WM worked out whose sensitive information was involved.

Date	What happened	Source
June 17, 2026	Unauthorized access to data begins	Notice letter, California AG record
September 2, 2026	WM becomes aware of a possible issue	Notice letter
September 3, 2026	Access ends	Notice letter
October 6, 2026	WM identifies the people involved	Notice letter
November 6, 2026	Letter date	Notice letter
90 days after the letter	Enrolment window for monitoring closes	Notice letter

California's record gives June 17, 2026 as the date of the breach. The intruder had access for 78 days before it ended, and letters went out nine weeks after WM noticed. The guide to social engineering in SEC filings shows how other companies have described this kind of entry.

Whose information was involved?

The letter does not say whether the people involved are customers, employees or others, and no state record fetched for this entry says either. It is signed by WM's Senior Vice President and Chief Human Resources Officer. The only data type it names is the Social Security number.

How many people were affected by the WM data breach?

Texas's attorney general posted WM's report on November 10, 2026, with 6,875 Texans affected. The Texas record lists Social Security numbers as the only type of information involved, and notice by U.S. mail. The figure counts Texans only, and no national total has been published. The ranking of breaches affecting Texans lists WM's report among the new ones posted since November 6.

What is WM offering?

Credit monitoring and identity protection at no charge, with alerts for 24 months from enrolment whenever the recipient's credit file changes. Cyberscout, a TransUnion company, provides the service, which comes with fraud assistance. Enrolment is at mytrueidentity.com with the activation code in the letter, within 90 days of the letter's date. On a letter dated November 6, 2026, that is February 4, 2027. The guide to credit-monitoring offers compares this term with other letters.

Was my information in the WM data breach?

A letter from WM dated November 6, 2026 means WM found your Social Security number in the accessed data. WM's line for questions is 1-855-711-9713, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern Time, excluding major U.S. holidays.

Has WM reported a breach before?

Yes. Oregon's breach list holds an earlier report from USA Waste-Management Resources, LLC, received on May 28, 2021. It covers a breach from January 21 to January 23, 2021, discovered on May 4, 2021, and gives 268,510 as the number affected. Oregon's list does not say whether that figure is a national total or a count of Oregon residents, and other reports on it use both. Oregon has no report of the 2026 incident yet; its list, read on November 10, 2026, runs to reports from October 21, 2026.

What the notice leaves open

• How many people were affected in all; Texas counts only its own residents. The sample's Rhode Island sentence ends where the number should be.
• Whether the people involved are customers, employees or both.
• Who was deceived, and how.
• What data the intruder reached besides Social Security numbers.

The guide to reading a California notice explains what the attorney general's record adds to a letter like this one.