The Maine Office of the Attorney General disclosed a data breach at Edge Federal Credit Union (EFCU) in December 2022, stemming from unauthorized access to an employee’s email account between August 8 and August 15, 2022. The incident compromised the personal and financial information of two Maine residents, including names, addresses, dates of birth, and financial account details. The breach was attributed to a phishing or credential-compromise attack, allowing threat actors to infiltrate the email system without immediate detection. While the scale of affected individuals appears limited (only two confirmed victims), the nature of the exposed data—particularly financial account information—poses significant risks, including identity theft, fraud, and financial loss for the impacted customers. The breach also raises concerns about internal security protocols, as the unauthorized access persisted for a week before mitigation. EFCU likely faced regulatory scrutiny under state and federal data protection laws (e.g., GLBA, Maine’s data breach notification statute), requiring mandatory disclosures and potential remediation measures for affected parties. The incident underscores vulnerabilities in email security and access controls, common vectors for cybercriminals targeting financial institutions.