M&Y Reports Data Breach Affecting Sensitive Personal and Health Information M&Y recently disclosed a data breach to the California Attorney General, revealing that unauthorized access to a server may have compromised sensitive personal identifiable information (PII) and protected health information (PHI). The incident was detected on November 25, 2025, when suspicious activity was identified within a server used for historical record-keeping. An investigation confirmed that an unauthorized third party accessed and potentially acquired data, prompting M&Y to review the impacted records. The exposed information varies by individual but includes names, Social Security numbers, financial account details, driver’s license or ID numbers, dates of birth, health insurance data, and medical records. On February 27, 2026, M&Y began notifying affected individuals via mail, providing details on the specific data exposed and offering complimentary credit monitoring services. The breach notice filed with California authorities outlines the scope of the incident and the steps taken in response.