TTC reported a data breach to the Attorney General of Maine, revealing that unauthorized third-party access occurred within its internal network between July 15 and July 26, 2025. The breach exposed sensitive personally identifiable information (PII) and protected health information (PHI), including names, addresses, dates of birth, government-issued IDs, financial account details, and health records. The incident was detected on July 21, 2025, prompting an investigation to assess the scope and affected individuals. By November 21, 2025, TTC began notifying impacted parties via mail, offering credit monitoring services as mitigation. The breach involved high-risk data categories, suggesting potential misuse for identity theft, financial fraud, or medical exploitation. The delayed disclosure (nearly four months post-detection) further amplifies reputational and regulatory risks, particularly under healthcare and financial data protection laws (e.g., HIPAA, state breach notification statutes).