On April 8, 2021, the Maine Office of the Attorney General disclosed a data breach affecting New Communities, Inc., stemming from a ransomware attack on Blackbaud, a third-party service provider. The breach was detected on February 25, 2021, and impacted 629 individuals, exposing highly sensitive personal information, including financial account numbers, Social Security numbers, and Medicaid numbers. The attack originated from Blackbaud’s systems, where threat actors encrypted data and exfiltrated unencrypted backups before demanding a ransom. While Blackbaud reportedly paid the ransom and received assurances of data destruction, the incident raised concerns over the long-term risks of identity theft, financial fraud, and unauthorized access to government-benefit records. The compromised data included personally identifiable information (PII) and protected health information (PHI), amplifying the severity due to the potential for sustained harm to affected individuals, including vulnerable populations reliant on Medicaid. The breach underscored vulnerabilities in third-party vendor security practices, particularly in sectors handling highly regulated data. New Communities, Inc. was among numerous organizations impacted by the Blackbaud incident, which affected nonprofits, healthcare providers, and educational institutions globally. The fallout included regulatory scrutiny, reputational damage, and the need for extensive remediation efforts, such as credit monitoring and identity protection services for victims.