The Maine Office of the Attorney General disclosed a data breach affecting EmPower HR in January 2021. The incident stemmed from unauthorized access to employee records between September 29, 2020, and October 30, 2020, detected on December 21, 2020. The breach exposed sensitive personal information, including at least one resident’s name and Social Security number (SSN), with a total of 4,214 individuals potentially impacted. The compromised data suggests a targeted intrusion aimed at internal employee records, likely through phishing, credential theft, or an exploited vulnerability in EmPower HR’s systems. While the exact method remains undisclosed, the exposure of SSNs—a high-value target for identity theft and fraud—elevates the risk of long-term harm to affected employees. The breach underscores systemic weaknesses in safeguarding personnel data, raising concerns over compliance with data protection regulations and the company’s cybersecurity posture. No evidence suggests the attack extended to customers or disrupted operations, but the scale and nature of the leaked data (employee PII) classify it as a significant internal data breach with potential financial and reputational repercussions for those affected.