The Washington State Office of the Attorney General disclosed a data breach affecting Convoy of Hope (COH), a nonprofit organization, in February 2021. The incident occurred on February 7, 2020, but was only detected on December 9, 2020, exposing the personal data of 1,017 Washington residents. The compromised information included names and full dates of birth, though no financial, medical, or highly sensitive details (e.g., Social Security numbers) were reported as stolen. The breach highlights a significant delay in detection (nearly 10 months), raising concerns about COH’s cybersecurity monitoring and response protocols. While the exposed data was limited to basic identifiers, such attacks can still enable identity theft, phishing, or fraud if combined with other leaked datasets. The lack of evidence suggesting broader exploitation (e.g., financial fraud or ransomware) suggests the attackers may have targeted personal records for secondary misuse rather than immediate monetary gain. COH likely faced reputational damage and potential regulatory scrutiny under state data protection laws, particularly given the prolonged exposure window. The incident underscores the vulnerabilities even nonprofits face in safeguarding constituent data against evolving cyber threats.