The City of Gloversville, New York Local data breach

What we know

The City of Gloversville, New York Local operates as a municipal government entity, providing essential public services, managing civic infrastructure, and overseeing administrative operations for its constituents. Because local governments serve as the central repository for a wide array of civic functions, the City routinely collects, processes, and maintains vast quantities of sensitive personal data. This includes exhaustive records pertaining to residents, municipal employees, local business owners, and individuals interacting with city departments for licensing, permitting, property taxes, and utility services. To fulfill its administrative mandate, the City must handle high volumes of personally identifiable information, making it a critical custodian of community data. In 2025, the City of Gloversville, New York Local reported a significant data security incident to the Massachusetts Attorney General, signaling a breach of its digital networks and data repositories. Incidents affecting municipal governments and local authorities typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized intrusions into legacy databases, or vulnerabilities exploited within third-party vendor platforms utilized for municipal management and billing. Because local government infrastructure often spans multiple interconnected departments—ranging from public works and tax assessors to police departments and human resources—an infiltration at one access point can expose enterprise-wide databases containing deeply personal records. The exposure resulting from this security failure compromises a comprehensive array of sensitive data categories, each presenting distinct and severe risks to affected individuals. Compromised files commonly contain full names, Social Security numbers, dates of birth, home addresses, property and utility account details, and municipal payroll or tax records. When such data falls into unauthorized hands, victims face an elevated, immediate risk of identity theft, financial fraud, tax refund fraud, and targeted phishing schemes. The inclusion of government-held records means that bad actors obtain baseline identifiers that can be leveraged across multiple facets of a victim's financial and personal life, creating long-term vulnerabilities that extend far beyond immediate monetary loss. As a custodian of public and employee data, the City of Gloversville, New York Local was bound by stringent legal obligations under state data protection statutes, common law duties of care, and applicable federal and state cybersecurity standards. These regulations mandate that municipal entities implement robust administrative, technical, and physical safeguards—including multi-factor authentication, network segmentation, regular vulnerability assessments, and employee cybersecurity training—to protect sensitive PII from unauthorized disclosure. The occurrence of a data breach of this magnitude serves as a strong indicator that the City failed to maintain adequate security controls, potentially breaching its legal duty to protect the private information entrusted to its care. Receiving a data breach notification letter from the City of Gloversville, New York Local is a formal acknowledgment that your private information was compromised due to inadequate security practices. Legally, this notification establishes the foundation for legal standing to participate in a class action lawsuit aimed at holding the municipality accountable. Affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to seek legal redress; the increased risk of future harm and the loss of privacy are actionable under the law. Our firm is actively investigating potential claims on behalf of impacted individuals, and we handle these cases on a contingency fee basis, meaning you pay nothing out of pocket and owe no fees unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.