St. Paul's School experienced a data breach due to a ransomware attack targeting its third-party service provider, Blackbaud, Inc. The incident occurred between February 7, 2020, and May 20, 2020, with unauthorized access to sensitive data. The breach impacted 4,480 individuals, including 104 Maine residents, exposing Social Security numbers—highly sensitive personal information. While the school offered two years of free credit monitoring and identity theft protection, the exposure of such critical data poses long-term risks, including identity theft, financial fraud, and reputational harm. The attack was part of a broader campaign against Blackbaud, affecting multiple organizations relying on its services. The compromised data did not include ransomware encryption of St. Paul’s own systems but stemmed from the provider’s vulnerability, highlighting supply-chain risks in cybersecurity.