On July 31, 2025, the American Association of Critical-Care Nurses (AACN) discovered a data breach in its website’s payment system, exposing personally identifiable information (PII) of 57,526 individuals in the U.S., including 186 Maine residents. The breach, active from March 8, 2025, to July 31, 2025, involved unauthorized access to payment card details (card number, expiration date, CVV), along with names, contact information, shipping/billing addresses, phone numbers, and email addresses.The incident was disclosed to the Maine Attorney General on August 29, 2025, with affected individuals notified the same day. While the exact method of compromise remains undisclosed, the breach poses significant risks of financial fraud and identity theft. AACN responded by offering two years of free credit and identity monitoring (via IDX) and advised victims to monitor financial statements for suspicious activity.The breach’s severity stems from the direct exposure of sensitive payment data, potentially enabling large-scale fraud. Though no ransomware was involved, the leak of customer financial and personal details underscores a critical failure in payment system security, necessitating heightened vigilance among affected parties.