The Vermont Office of the Attorney General disclosed a data breach at Pratt & Whitney Engine Services (PWES) on November 16, 2023, caused by improper folder permissions on file servers. The incident exposed sensitive personal information, including dates of birth, Social Security numbers, and health data of affected individuals. While the breach was internal—with only PWES employees accessing the data—the exact number of impacted individuals remains undetermined. The exposure of such highly sensitive details, particularly health and financial identifiers, poses significant risks, including potential identity theft, fraud, or misuse of personal records. The breach underscores vulnerabilities in access controls, raising concerns about the company’s data governance and the protection of employee and possibly customer information. No evidence suggests external malicious actors were involved, but the unauthorized internal access itself constitutes a serious lapse in security protocols.