The Maine Office of the Attorney General disclosed a data breach at Devine Millimet & Branch, a law firm, where unauthorized actors gained access to its network between August 13, 2020, and September 6, 2020. The incident exposed sensitive personal information of 19,396 individuals, including 261 Maine residents, with Social Security numbers (SSNs) among the compromised data. The breach was not publicly reported until June 24, 2021, nearly 10 months after the initial intrusion, raising concerns about delayed notification and potential misuse of the stolen data. The exposure of SSNs poses significant risks, including identity theft, financial fraud, and long-term reputational harm to affected individuals. As a law firm, the breach also undermines client trust and may lead to legal liabilities, regulatory scrutiny, and financial penalties under data protection laws. The prolonged unauthorized access suggests possible advanced persistent threat (APT) activity, though the exact attack vector (e.g., phishing, exploited vulnerability) was not specified. The incident highlights vulnerabilities in the firm’s cybersecurity posture, particularly in detection, response, and disclosure protocols.