The New-York Historical Society suffered a data breach due to a ransomware attack on its third-party vendor, Blackbaud, in May 2020. The incident exposed the personal information of 2,748 individuals, including Social Security numbers, with 3 Maine residents among the affected. While the breach was reported to authorities, notifications to impacted individuals were delayed until December 22, 2020. As a remedial measure, the society offered 24 months of identity theft protection services to those affected. The attack originated from a vulnerability in Blackbaud’s systems, leading to unauthorized access and potential misuse of sensitive data. The delayed disclosure and the nature of the compromised information—particularly SSNs, which are high-value targets for identity theft—heighten the severity of the incident. The breach underscores risks associated with third-party vendor security lapses and the cascading impact on client organizations.