What happened in the HILT-Trust 2020-A data breach?

HILT-Trust 2020-A recently reported a data breach involving sensitive personal information. The incident became public on September 9, 2026, when it was reported to the Texas and Vermont Attorneys General. The Texas filing identifies the reporting entity more broadly as “HILT-Trust 2020-A and its underlying trusts and affiliates” and provides a New York address. Vermont classifies HILT-Trust 2020-A as a financial-services organization. Vermont Attorney General Security Breach Notices; Texas Attorney General Data Security Breach Reports

According to the Texas Attorney General’s data breach registry, the HILT-Trust 2020-A breach affected 6,100 Texas residents. The compromised information may have included individuals’ names, addresses, Social Security numbers, dates of birth, and an additional category listed only as “other.” The filing does not explain what information falls within that unspecified category. The Vermont Attorney General separately reports that 91 Vermont residents were affected and identifies Social Security numbers as the compromised data category. Approximately 41,153 people are believed to have been affected nationwide.

HILT-Trust 2020-A reportedly provided written notice to affected individuals by U.S. mail. The information exposed may have varied from person to person, and the regulatory filings do not establish that every affected individual had every listed category of information compromised.

At this stage, important details about how the HILT-Trust 2020-A data breach occurred remain undisclosed. The available government records do not identify the initial attack vector or state whether the incident involved ransomware, phishing, stolen credentials, a compromised vendor, or another form of unauthorized access. They also do not provide the dates on which the unauthorized activity began or ended, when the incident was discovered, or when the investigation determined that personal information was involved. No public finding of data misuse appears in the reviewed filings.

The key confirmed date is September 9, 2026, when the HILT-Trust 2020-A breach was reported in Texas and Vermont. Because the public filings presently contain only limited information, further details may emerge through consumer notification letters, amended regulatory reports, or subsequent disclosures. Any description of the breach’s cause or internal timeline beyond the facts above would currently be speculative.

How did the HILT-Trust 2020-A breach occur?

The precise cause of the HILT-Trust 2020-A data breach has not yet been publicly disclosed. The available Texas and Vermont Attorney General records do not explain whether the incident resulted from hacking, phishing, ransomware, stolen credentials, an employee error, or a compromised third-party service provider. Vermont Attorney General Security Breach Notices; Texas Attorney General Data Security Breach Reports

When did the HILT-Trust 2020-A breach occur?

The date or period when the HILT-Trust 2020-A data breach occurred has not been publicly disclosed. The available government records do not identify when unauthorized access began or ended, or when the incident was discovered. Vermont Attorney General Security Breach Notices; Texas Attorney General Data Security Breach Reports

How many people were affected by the HILT-Trust 2020-A breach?

Approximately 41,153 individuals were affected by the HILT-Trust 2020-A data breach. According to the Texas Attorney General’s data breach registry, 6,100 Texas residents were affected. The Vermont Attorney General separately reports that 91 Vermont residents were affected. Vermont Attorney General Security Breach Notices; Texas Attorney General Data Security Breach Reports

What information was exposed in the HILT-Trust 2020-A breach?

• The information exposed in the HILT-Trust 2020-A data breach may have included:
  • Names
  • Addresses
  • Social Security numbers
  • Dates of birth
  The affected information may have varied by individual, and the filings do not indicate that every person had every category exposed. Vermont Attorney General Security Breach Notices; Texas Attorney General Data Security Breach Reports

Has HILT-Trust 2020-A offered free credit monitoring and/or identity theft protection services?

There is currently no public confirmation that HILT-Trust 2020-A offered free credit monitoring or identity-theft protection services.

The Texas Attorney General filing confirms that affected individuals were notified by U.S. mail, but it does not identify any monitoring provider, enrollment period, or complimentary protection service. Vermont’s public registry likewise does not include that information, and its website does not publish the underlying consumer-notification letters. Vermont Attorney General Security Breach Notices; Texas Attorney General Data Security Breach Reports

HILT-Trust 2020-A data breach timeline:

Date	Event
UNCONFIRMED	Unauthorized activity began.
UNCONFIRMED	HILT-Trust 2020-A discovered the incident.
UNCONFIRMED	Unauthorized activity ended.
UNCONFIRMED	Data breach investigation concluded.
September 9, 2026	HILT-Trust 2020-A began notifying affected individuals.

What is HILT-Trust 2020-A?

HILT-Trust 2020-A, which appears to be affiliated with the Hilton Grand Vacations Trust 2020-A, is a Delaware-based special-purpose trust affiliated with Hilton Grand Vacations Inc. The trust was established in 2020 as a financing vehicle to issue $300 million in asset-backed securities supported by a pool of fixed-rate vacation-ownership loans originated by Hilton Resorts Corporation or its subsidiaries. HILT-Trust 2020-A functions as a securitization entity rather than a hotel, resort, or consumer-facing vacation company. Hilton Grand Vacations Completes $300 Million Term Securitization

What should you do if you received a HILT-Trust 2020-A data breach letter?

If you received a HILT-Trust 2020-A data breach letter, take the notice seriously because the exposed information may include names, addresses, dates of birth, and Social Security numbers. Consider taking these steps:

• • Confirm the letter is authentic. Avoid clicking unfamiliar links or scanning QR codes in the notice until you verify them independently. Compare the letter with the information published by the state attorney general or contact the organization using previously known contact information.
  • Review the notice carefully. Determine which information belonging to you was affected, whether the letter provides an enrollment deadline, and whether complimentary credit monitoring or identity-theft protection is offered.
  • Consider freezing your credit. Contact Equifax, Experian, and TransUnion separately to place a free security freeze. A freeze makes it more difficult for someone to open a new credit account in your name, remains effective until you lift it, and does not affect your credit score. The FTC considers a freeze especially important when a Social Security number has been exposed. FTC: Credit Freezes and Fraud Alerts
  • Consider placing a fraud alert. An initial fraud alert instructs potential creditors to verify your identity before extending new credit. Contacting one of the three major credit bureaus is sufficient because that bureau must notify the other two. FTC: Credit Freezes and Fraud Alerts
  • Review your credit reports. Obtain reports from all three bureaus through AnnualCreditReport.com, the federally authorized source. Look for unfamiliar accounts, credit inquiries, addresses, or collection activity.
  • Monitor financial and government accounts. Review bank, credit-card, retirement, and loan statements for unauthorized activity. Create or secure your my Social Security account and review your earnings history for irregularities.
  • Consider obtaining an IRS Identity Protection PIN. An IP PIN prevents another person from filing a federal tax return using your Social Security number. Eligible taxpayers can request one through: IRS: Get an identity protection PIN (IP PIN)
  • Watch for targeted scams. Criminals may combine an exposed name, address, birth date, and Social Security number to create convincing calls, emails, or letters. Do not provide passwords, verification codes, or additional personal information in response to unsolicited communications.
  • Report suspected identity theft promptly. If you discover fraudulent activity, contact the affected institution, dispute inaccurate credit-report entries, and visit IdentityTheft.gov to create an FTC Identity Theft Report and personalized recovery plan.
  • Preserve your records. Keep the breach letter, its envelope, monitoring-enrollment confirmation, credit reports, correspondence, receipts, and documentation of any fraudulent transactions or time spent addressing the incident. These materials may be important if you later need to dispute fraud or establish losses.

Sources and additional information about the data breach:

• • Hilton Grand Vacations Completes $300 Million Term Securitization
  • Vermont Attorney General Security Breach Notices
  • Texas Attorney General Data Security Breach Reports
  • my Social Security
  • Medicare.gov: Reporting Medicare fraud & abuse
  • FTC: Checking Your Credit Report
  • FTC: Credit Freezes and Fraud Alerts
  • AnnualCreditReport.com
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • IRS Identity Theft Guide Central
  • IRS: Get an identity protection PIN (IP PIN)
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the HILT-Trust 2020-A data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the HILT-Trust 2020-A data breach, HILT-Trust 2020-A data breach notice, HILT-Trust 2020-A class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by HILT-Trust 2020-A or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.