Bath Fitter Distributing Inc. Discloses Data Breach Impacting Sensitive Consumer Information Bath Fitter Distributing Inc., a corporate affiliate of the Bath Fitter brand, recently reported a data breach that compromised sensitive personal and financial information. The incident was disclosed to the Vermont Attorney General on July 16, 2026, with at least 44 Vermont residents confirmed as affected. The breach exposed multiple categories of highly sensitive data, including Social Security numbers, government identification numbers, financial account details, and credit/debit card information. In response, Bath Fitter Distributing has initiated notifications to impacted individuals, as outlined in its regulatory filing. The company advises those who receive a notice to review it carefully and follow any provided instructions. Consumers who suspect their data may have been exposed but have not yet been contacted can reach out to Bath Fitter Distributing for further details.

Bath Fitter Faces Partial Data Breach Lawsuit Over Employee Impersonation Incident A federal court in Vermont has allowed key claims in a proposed class-action lawsuit against Bath Fitter (operating as National Bath Systems LLC) to proceed, following allegations that the company failed to protect an employee’s personal data from a breach. Plaintiff Margaret Malaterre successfully argued that Bath Fitter’s negligence and breach of an implied contract stemming from its alleged failure to implement adequate security measures left her vulnerable to financial harm. The complaint centers on an incident where an attacker impersonated an IT support technician, potentially gaining access to sensitive employee information. Malaterre’s lawsuit seeks injunctive relief and damages for mitigation costs, asserting that Bath Fitter had an obligation to safeguard her data upon collection. The ruling, issued by the U.S. District Court for the District of Vermont, permits the case to advance on claims of negligence and breach of implied contract, though other aspects of the lawsuit may still face dismissal. The decision underscores growing legal scrutiny over corporate data protection practices, particularly in cases involving employee or customer information exposed through social engineering attacks. No details on the breach’s scope, timing, or specific data compromised have been disclosed in the court filings. The case remains ongoing.

The New York Attorney General reported that Bath Fitter experienced a data breach due to a ransomware attack between December 4 and December 5, 2024. The breach potentially affected personnel files, including sensitive information such as social security numbers, financial account numbers, and health-related information, although the exact number of individuals impacted is unknown.