On November 11, 2021, the Washington State Office of the Attorney General disclosed that Opportunity Council suffered a cybersecurity incident involving unauthorized access to employee email accounts between February 18, 2021, and June 29, 2021. The breach exposed sensitive personal and financial data of 664 Washington residents, including names, Social Security numbers, driver’s license numbers, health information, and financial account details. The incident stemmed from a phishing or credential-compromise attack, allowing threat actors to infiltrate internal systems and exfiltrate confidential records. While the exact method of exploitation (e.g., malware, social engineering) was not specified, the prolonged access period (over four months) suggests a sophisticated and persistent intrusion. The compromised data—particularly health and financial records—poses significant risks of identity theft, fraud, and long-term reputational harm to affected individuals. The organization likely faced regulatory scrutiny under state data protection laws, requiring breach notifications, credit monitoring for victims, and potential fines. The attack underscores vulnerabilities in email security protocols and the critical need for multi-factor authentication (MFA), endpoint detection, and employee cybersecurity training to prevent similar incidents.