The Vermont Office of the Attorney General disclosed a data breach affecting The Columbus Foundation in September 2023. An unauthorized external actor exposed internal data by posting internet links containing sensitive personal information. The compromised data potentially included names, addresses, driver’s license numbers, and Social Security numbers of applicants participating in the foundation’s programs. The breach was detected after the data had already been leaked, with the incident originating in early July 2023. While the full scope of the exposure remains under investigation, the leaked information poses significant risks, including identity theft, financial fraud, and reputational harm to the affected individuals. The foundation has not confirmed whether the breach was part of a broader cyberattack (e.g., ransomware or phishing) or resulted from an unpatched vulnerability. Authorities are likely assessing the extent of the damage and potential legal ramifications under data protection laws.