Jones & Beach Engineers, Inc. suffered a data breach due to unauthorized access to an employee's email account between December 27, 2023, and January 23, 2024, which was detected on March 29, 2024. The incident exposed sensitive information, including the Social Security numbers (SSNs) of 2 Maine residents, along with data from a total of 52 individuals. The breach posed risks of identity theft and financial fraud, prompting the company to notify affected parties on May 15, 2024, and offer 24 months of identity theft protection services via Kroll. The breach stemmed from a compromised employee account, likely through phishing or credential theft, leading to unauthorized access to personally identifiable information (PII). While the scale was relatively limited (52 individuals), the exposure of SSNs—highly sensitive data—elevates the severity due to potential long-term consequences for victims, including fraud, credit damage, and identity misuse. The delayed discovery (nearly three months after initial access) further exacerbates risks, as attackers may have exploited the stolen data during that period. The company’s response included mitigation measures, but the incident underscores vulnerabilities in email security and the critical need for proactive monitoring.