dbHMS Data Breach Lawsuit Investigation
Received an August 2026 breach notice from dbHMS?
Dapeer Law, P.A. is investigating a potential class action against Nest Builders, Inc. d/b/a dbHMS, a Chicago-based engineering services firm, on behalf of individuals whose personal information may have been exposed in the cyber incident the company disclosed to Massachusetts regulators in August 2026.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from dbHMS dated August 2026.
- Your letter offered enrollment in 24 months of free Equifax credit monitoring and identity protection administered by HaystackID.
- You had personal information held by dbHMS, whether as an employee, a former employee, a contractor, or another individual whose records the firm maintained.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
Nest Builders, Inc., which does business as dbHMS, reported a data security incident to the Office of the Massachusetts Attorney General on August 6, 2026. The company's notice letter states that an unauthorized party gained access to information dbHMS maintained. The notice does not say when the unauthorized access began or ended, when the activity was discovered, or how the intrusion occurred, and the cause has not been made public.
dbHMS began mailing notice letters to affected individuals on August 5, 2026. The letters report that the information involved may have included names, Social Security numbers, driver's license numbers, state-issued identification card numbers, passport information, other government identification numbers, and medical information. The company is offering 24 months of complimentary credit monitoring and identity protection through Equifax, administered by HaystackID, and recipients have 90 days from the date on their letter to enroll. The Massachusetts filing reports 2 Massachusetts residents affected, and dbHMS has not publicly stated a nationwide total.
The categories listed in the notice are among the most sensitive an individual can have exposed. Social Security numbers, passport details, and other government identification numbers cannot be reissued as easily as a payment card, and medical information carries an added risk of insurance and medical identity fraud. Dapeer Law is evaluating whether dbHMS maintained reasonable safeguards for this information and whether notice was provided without unreasonable delay.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the activation code for the offered credit monitoring and is important evidence if you decide to participate in a lawsuit.
Enroll in the free 24-month credit monitoring
Your letter includes an activation code for Equifax credit monitoring and identity protection administered by HaystackID. Enrollment is free and must be completed within 90 days of the date on your letter. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Because the notice lists medical information, also review any Explanation of Benefits statements for services you did not receive.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options under Massachusetts and other state data breach laws, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, medical-claim fraud, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring dbHMS to implement stronger data security practices going forward, including specific safeguards for the Social Security numbers, government identification numbers, and medical information the firm maintains.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from dbHMS. What should I do? +
Keep the letter, including the activation code, because it identifies you as an affected individual. Enroll in the free Equifax credit monitoring within 90 days of the date on the letter, review your credit reports at AnnualCreditReport.com, and consider a fraud alert or credit freeze with Equifax, Experian, and TransUnion. Because the notice lists medical information, also watch for Explanation of Benefits statements covering care you did not receive. You can then speak with a data breach attorney at no cost about your options.
Am I eligible to join a class action against dbHMS? +
If you received a dbHMS notice letter dated on or about August 5, 2026, you are likely within the group under review. Eligibility for any future class action depends on your state of residence, which categories of your information were involved, and whether you have documented out-of-pocket losses or time spent responding to the incident. Dapeer Law reviews notice letters at no cost to confirm where you stand.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The notice letter reports that the information involved may have included names, Social Security numbers, driver's license numbers, state-issued identification card numbers, passport information, other government identification numbers, and medical information. Not every category applies to every recipient, so check your individual letter, which lists the data elements involved for you specifically.
Did dbHMS offer free credit monitoring? +
Yes. dbHMS is offering 24 months of complimentary credit monitoring and identity protection through Equifax, administered by HaystackID, with proactive fraud assistance available through Haystack. Enrollment must be completed within 90 days of the date on your letter using the activation code it contains. Enrolling does not waive your right to pursue a claim.
How many people were affected by the dbHMS breach? +
The filing with the Massachusetts Attorney General reports 2 Massachusetts residents. dbHMS has not publicly disclosed a nationwide total, and filings in other states may raise that number. This page will be updated as additional filings become available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The sample notice letter was filed with the Office of the Massachusetts Attorney General and can be downloaded from the Attorney General's public breach notification records. If you cannot locate a copy or no longer have your letter, Dapeer Law can help you obtain one during a free consultation.
Sources & references
- Official breach notice filing · Massachusetts Attorney General, Nest Builders, Inc. d/b/a dbHMS breach notice (PDF)
- Company · Nest Builders, Inc. d/b/a dbHMS (dbhms.com)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
