The Vermont Office of the Attorney General disclosed a data breach at Goodwill Industries of Greater New York and Northern NJ on May 24, 2023. The incident involved unauthorized access to an employee’s email account between October 12 and October 29, 2022, exposing sensitive personal information of an unspecified number of individuals, including names and additional details. While the exact scope of compromised data remains undisclosed, the breach suggests potential exposure of employee or customer-related information stored in the email system. In response, the organization is providing 24 months of free credit monitoring services via Experian to affected individuals, indicating concerns over possible financial fraud or identity theft risks. The breach highlights vulnerabilities in email security protocols, raising questions about internal access controls and the protection of personally identifiable information (PII). No evidence suggests ransomware or large-scale system disruption, but the incident underscores the risks of phishing or credential compromise leading to data exposure.