On December 9, 2020, the Maine Office of the Attorney General disclosed a data breach affecting Blair Academy, stemming from an external cyberattack on Blackbaud, a third-party vendor. The breach, which occurred on May 20, 2020, compromised sensitive personal information of 4,773 individuals, including 13 Maine residents. The exposed data included names, addresses, and Social Security numbers—highly sensitive details that pose significant risks of identity theft, financial fraud, and long-term reputational harm. The incident was attributed to hacking, where unauthorized actors exploited vulnerabilities in Blackbaud’s systems, leading to unauthorized access and exfiltration of data. While the breach did not involve ransomware, the scale and nature of the leaked information—particularly Social Security numbers—elevate the severity due to the potential for severe financial and personal consequences for affected individuals. The breach underscores vulnerabilities in third-party vendor security, raising concerns about supply chain risks and the adequacy of data protection measures in place at the time.