Mercyhurst University suffered an external system breach (hacking) between January 16, 2022, and May 15, 2022, exposing sensitive personal data of 19,537 individuals, including 39 Maine residents. The compromised information included names, Social Security numbers, and financial account details, posing a severe risk of identity theft and financial fraud. The university issued written notifications in two phases (November 8, 2022, and February 21, 2023) and offered 12 months of credit monitoring via Epiq to affected individuals. The breach’s prolonged duration (nearly four months) and the nature of the stolen data—highly sensitive financial and identification records—heighten the potential for long-term harm, including fraudulent transactions, credit damage, and reputational erosion for the institution. The incident underscores vulnerabilities in the university’s cybersecurity defenses, particularly against external intrusions targeting personally identifiable information (PII).