If you were affected, free legal review is available — no obligation.
Learn how to participate in the class action and what compensation you may be entitled to.
Join the Class Action →Use our verification tool to confirm your letter matches this official AG filing.
Verify My Notice LetterThis case file references a public filing made with the state filing in VT. This website is not affiliated with, endorsed by, or operated by any state government agency.
Petco Animal Supplies Stores, Inc. was the subject of a data breach notification filed with the VT Attorney General. The AG filing was recorded on September 10, 2026.
From the AG filing description
Petco Animal Supplies Stores, Inc. is a leading nationwide pet specialty retailer dedicated to comprehensive animal care, wellness services, and pet supplies. Operating hundreds of brick-and-mortar locations alongside a robust e-commerce platform, the company interacts daily with millions of pet owners. To facilitate seamless online shopping, scheduled grooming services, veterinary care, recurring subscription deliveries, and loyalty programs, Petco collects and retains vast repositories of customer Personally Identifiable Information (PII) and financial credentials. Because modern retail ecosystems rely heavily on integrated digital infrastructure, inventory management systems, and third-party vendor partnerships, the volume of sensitive consumer data managed by the company makes it an attractive target for malicious cyber actors. In 2026, Petco reported a significant data security incident to the Vermont Attorney General's office, raising urgent concerns among consumers regarding the safety of their digital profiles. While details surrounding the exact vector of the breach continue to emerge, security incidents affecting major national retailers typically involve sophisticated external intrusions, credential stuffing attacks, or vulnerabilities within third-party vendor supply chains. Unauthorized parties may have gained entry into customer databases or payment processing environments, potentially evading internal monitoring controls for an extended period before discovery and containment. Data breach notifications issued by major retailers generally reveal the exposure of high-risk information, including customers' full names, email addresses, physical mailing addresses, telephone numbers, encrypted or hashed passwords, and detailed purchase or order histories. Furthermore, depending on the scope of the accessed systems, payment card information—such as credit or debit card numbers, expiration dates, and security codes—may have been compromised. The exposure of this combination of data creates severe, tangible risks for affected consumers. Cybercriminals can leverage credentials for credential stuffing across other web services, execute targeted phishing campaigns using purchase histories to trick consumers into divulging deeper financial details, or engage in fraudulent credit card transactions and identity theft. Under Vermont state data protection laws, as well as Section 5 of the Federal Trade Commission Act, Petco has an affirmative legal obligation to implement and maintain reasonable cybersecurity measures to safeguard consumer data against unauthorized access, destruction, modification, or disclosure. When a major retail corporation suffers a breach of this magnitude, it often indicates systemic shortcomings in network segmentation, multi-factor authentication enforcement, or timely software patching. Failing to maintain adequate digital defenses constitutes a direct breach of implied contracts and statutory duties, leaving consumers vulnerable through no fault of their own. Receiving an official data breach notification letter from Petco is not merely an administrative warning; it serves as a formal legal acknowledgment that your confidential information was compromised due to corporate security failures. Under modern jurisprudence, this notification often provides the requisite legal standing to initiate or participate in a class action lawsuit against the company. Crucially, affected consumers do not need to demonstrate actual financial loss or fraudulent charges to seek legal recourse; the mere exposure and increased risk of future identity theft are sufficient grounds to hold the corporation accountable. Our law firm investigates these data security failures on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket unless we successfully recover compensation on your behalf.
Under the Vermont Security Breach Notice Act, you may have a legal claim against Petco Animal Supplies Stores, Inc. if any of the following apply:
Based on the data types reported in this filing:
Phone numbers exposed in breaches are used for SIM swapping attacks — hijacking your number to bypass two-factor authentication on financial accounts.
Common categories of compensation in data breach class actions
Courts recognize that the time spent monitoring accounts, placing credit freezes, and dealing with the aftermath of a breach has real economic value. This category of damages is recoverable even without direct financial loss.
Direct financial losses resulting from the breach — unauthorized charges, fraudulent transfers, or fees incurred through fraud — are recoverable as compensatory damages. Banks may reverse some charges; a class action recovers the remainder and associated costs.
When login credentials are exposed, the costs of downstream account compromises — password managers, security audits, and recovery costs for hijacked downstream accounts — can be recovered. Courts in recent class actions have awarded damages for credential exposure even without proven misuse.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Vermont Security Breach Notice Act and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from Petco Animal Supplies Stores, Inc. does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by Petco Animal Supplies Stores, Inc. during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Most data breach class actions resolve within 18 to 36 months, though timelines vary by court and complexity. Your participation requires minimal effort — typically completing a claim form. Our office handles all litigation; you are notified when a settlement is reached.
Applicable State Law
This breach was reported under the Vermont Security Breach Notice Act, which mandates notification and establishes your right to seek damages.
Case review window ends November 5, 2026 — review your letter.
Review Your Letter →Petco Animal Supplies Stores, Inc. breach?
Free case review · No fee unless you win