The Maine Office of the Attorney General disclosed a data breach affecting CenturyLink Communications between August 20 and August 31, 2020. The incident stemmed from a sophisticated password-guessing attack targeting the MyCenturyLink customer portal, compromising 1,942 accounts. Exposed data included usernames, email addresses, full names (first and last), service addresses, billing addresses, and related account details. While no financial or highly sensitive information (e.g., Social Security numbers, payment card data) was confirmed stolen, the breach risked unauthorized access to personal and account-specific information, potentially enabling phishing, identity fraud, or further targeted attacks. CenturyLink responded by issuing written notifications to affected customers between September 21–25, 2020, though the delay between discovery and disclosure raised concerns about proactive mitigation. The attack highlighted vulnerabilities in authentication mechanisms, emphasizing the need for stronger password policies and multi-factor authentication (MFA) to prevent credential-stuffing exploits.