Echo reported a data breach to the Vermont Attorney General, where unauthorized third parties potentially accessed and acquired sensitive personal identifiable information (PII) between July 25–28, 2025. The breach was detected on July 28, 2025, prompting an investigation. While the exact compromised data remains undisclosed as of November 24, 2025, Vermont’s guidelines define affected PII as potentially including names, Social Security numbers, driver’s license/ID numbers, financial account details, biometric/genetic data, and health records. Echo began notifying impacted individuals on November 21, 2025, offering credit monitoring services. The breach suggests exposure of highly sensitive customer data, though no confirmation of misuse (e.g., fraud, identity theft) has been reported. The incident highlights risks to financial, reputational, and privacy integrity, with potential long-term consequences for affected individuals.