Waste-Managment Data Breach

For about 11 weeks in 2026, an unauthorized person had access to systems at a WM company after tricking their way in. The information involved includes Social Security numbers.

What Happened at USA Waste-Management Resources

USA Waste-Management Resources, LLC is part of WM, the Houston-based waste and recycling company. On November 6, 2026, it reported a data breach to the California and Vermont Attorneys General.

According to those filings, an unauthorized person gained access through social engineering between June 17 and September 3, 2026. Social engineering means tricking a person, often by phone, email or text, into handing over access or login details. It does not require breaking in through software flaws.

The filings list Social Security numbers among the information involved.

How Long the Access Lasted

The access window ran from June 17 to September 3, 2026. That is about 11 weeks. Notices were filed on November 6, 2026, about nine weeks after the access ended.

WM has not publicly explained why the access went unnoticed for that long, based on the filings reviewed.

How Many People Were Affected?

The Vermont filing lists 6 Vermont residents. The California filing indicates more than 500 California residents, since California posts notices only above that number. Together, that is at least 506 people.

WM has not disclosed a national total in the sources reviewed. The real number could be much higher.

This 2026 incident is separate from an earlier WM data breach reported in 2021. The two should not be confused.

What Information Was Exposed?

Based on the state filings, the information involved includes:

• Social Security numbers

The filings may not list every data type. Anyone who received a letter should check it for the full list.

What Is WM Offering Affected Individuals?

In the sources reviewed, WM has not publicly disclosed whether it is offering credit monitoring or identity protection. Anyone who received a letter should check it for enrollment details and deadlines.

Your Information Is at Risk

A Social Security number is one of the most valuable pieces of data a criminal can get. It can be used to open credit, file false tax returns and apply for benefits. It also does not expire.

Affected individuals should:

• Place a free credit freeze with Equifax, Experian and TransUnion
• Check your credit reports for accounts you do not recognize
• File your taxes early and consider an IRS Identity Protection PIN
• Keep a copy of any notice letter you receive
• Talk with a data breach attorney about your options

Do You Have Legal Options?

Large companies that store Social Security numbers have a legal obligation to train staff, guard against social engineering and protect that data. When that obligation is not met, affected individuals may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the WM data breach?

WM has not shared a total. State filings show 6 Vermont residents and more than 500 California residents, so at least 506 people.

What information was exposed?

• Social Security numbers

Your letter may list more. Keep it.

What is social engineering?

It is a scam that targets people instead of computers. A criminal might pose as a coworker, a vendor or tech support to get someone to share a password or grant access.

Is this the same as the 2021 WM breach?

No. This incident took place between June 17 and September 3, 2026, and was reported on November 6, 2026. It is separate from the earlier breach.

What should I do if I received a notification letter?

• Place a free credit freeze with Equifax, Experian and TransUnion
• Check your credit reports for accounts you do not recognize
• File your taxes early and consider an IRS Identity Protection PIN
• Keep a copy of any notice letter you receive
• Talk with a data breach attorney about your options

Why is a stolen Social Security number such a big deal?

A Social Security number is hard to change and does not expire. With a name and SSN, a criminal may try to:

• Open new credit cards or loans
• File a fake tax return to claim a refund
• Apply for jobs or benefits in your name

That is why a credit freeze is one of the strongest steps you can take.

Could scammers use this breach to contact me?

Yes, that is a common risk after a breach. Criminals sometimes send emails, texts or calls that mention the incident by name to seem real. Be careful with any message that:

• Asks you to confirm your Social Security number or account details
• Pushes you to act fast or pay a fee
• Includes a link or attachment you did not expect

When in doubt, contact the company using a phone number or website you already trust.

Do I have a legal claim?

You may. Organizations that collect Social Security numbers and other sensitive information have a duty to protect it and to tell people promptly when it is exposed. If WM did not meet those duties, you may have legal rights and remedies. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.