The Vermont Office of the Attorney General disclosed a data breach at Epic Management, detected on September 2, 2021, but reported publicly on December 14, 2022. The incident involved unauthorized access to the company’s email environment, where attackers exploited vulnerabilities to infiltrate certain files. While the breach exposed personal information, including names, the exact scope of affected individuals remains undetermined. The attack did not explicitly confirm theft of sensitive data beyond basic identifiers, nor did it result in financial fraud, operational disruption, or broader systemic harm. However, the exposure of personal details—even if limited—poses reputational risks and potential phishing or identity-based threats for affected parties. The delayed discovery (over a year between breach and reporting) further amplifies concerns about incident response effectiveness and data protection protocols. No evidence suggests ransomware, large-scale financial loss, or critical infrastructure compromise. The primary impact revolves around unauthorized access to non-financial personal data, with no confirmed misuse at the time of disclosure.