The Vermont Office of the Attorney General disclosed a data breach affecting Dolly, Inc., which occurred on August 26, 2023. The incident involved the unauthorized exposure of personal information, specifically names and Social Security numbers (SSNs) of individuals. The breach was formally reported on November 2, 2023, though the exact number of affected individuals remains undetermined as of the disclosure.The compromised data—particularly SSNs—poses significant risks, including identity theft, financial fraud, and long-term reputational harm to the impacted individuals. Given the sensitivity of SSNs, the breach suggests a high potential for misuse, as such identifiers are often targeted for illicit financial activities or further cyber exploits. The delayed reporting (over two months) may also exacerbate risks, as affected parties were left uninformed and vulnerable during this period.While the root cause (e.g., phishing, system vulnerability, or external attack) was not specified, the exposure of personally identifiable information (PII) without ransomware involvement aligns with severe data protection failures. The incident underscores the company’s obligation to enhance cybersecurity measures, transparency, and timely notifications to mitigate fallout for stakeholders.