The Maine Office of the Attorney General disclosed a data breach affecting Enstar (US) Inc. in November 2023, stemming from an exploit by the CL0P criminal group. The breach occurred between May 29–31, 2023, leveraging a zero-day vulnerability in the MOVEit Transfer tool, a widely used file-transfer software. The incident compromised sensitive data of 44,114 individuals, including 51 Maine residents, with Social Security Numbers (SSNs) among the exposed information. The attack highlights the risks of third-party software vulnerabilities, where threat actors exploit unpatched flaws to exfiltrate high-value personal data. SSNs are critical identifiers for identity theft, financial fraud, and long-term reputational harm to affected individuals. While the breach did not involve ransomware or direct financial demands, the scale and sensitivity of the leaked data—particularly SSNs—pose severe risks of downstream fraud, regulatory scrutiny (e.g., under U.S. state breach laws), and erosion of customer trust. Enstar’s response likely involved forensic investigations, notification protocols, and mitigations like credit monitoring for victims. The incident underscores the broader trend of supply-chain attacks, where vulnerabilities in widely deployed tools (e.g., MOVEit) create cascading risks across organizations relying on them.