Gibbs & Cox, Inc. suffered a prolonged data breach between March 2017 and December 2019, where unauthorized actors gained access to their systems. The incident exposed sensitive personal information of 2,265 individuals, including 77 Maine residents. Compromised data included Social Security numbers, names, and addresses—highly sensitive details that could facilitate identity theft or financial fraud. The company responded by issuing written notifications to affected individuals on November 16, 2020, and offered 24 months of credit monitoring services via TransUnion to mitigate potential harm. The breach’s extended duration (nearly three years) suggests persistent vulnerabilities in their security posture, raising concerns about the adequacy of their detection and response mechanisms. The exposure of Social Security numbers—a critical identifier—heightens the risk of long-term repercussions for victims, including fraudulent loans, tax filings, or other malicious activities exploiting stolen identities.