The Maine Office of the Attorney General disclosed a data breach affecting CopperPoint Insurance Company (alongside affiliated entities) on November 9, 2021, though the incident was initially detected on July 22, 2021. The breach stemmed from unauthorized access to employee email accounts, compromising sensitive data. The exposed information primarily included Social Security Numbers (SSNs), impacting 38,653 individuals, of which at least 2 were Maine residents. The breach highlights vulnerabilities in email security protocols, enabling attackers to infiltrate systems and exfiltrate personally identifiable information (PII). While the exact method of unauthorized access (e.g., phishing, credential stuffing) was not specified, the exposure of SSNs poses significant risks, including identity theft, financial fraud, and long-term reputational damage for affected individuals. The company likely faced regulatory scrutiny under state data protection laws, necessitating breach notifications, credit monitoring for victims, and potential fines. The incident underscores the critical need for robust email security measures, such as multi-factor authentication (MFA), employee cybersecurity training, and continuous monitoring to prevent similar exploits. The delayed public disclosure (nearly 4 months after detection) may further erode trust in the company’s transparency and incident response capabilities.