The Washington Post reported a hacking incident to state attorneys general. The official Maine filing states that unauthorized access began on July 10, 2025, and identifies October 27, 2025, as the date the breach was discovered. The filing describes the incident as an external system breach involving hacking.
The Maine filing reports 9,720 affected individuals, including 31 Maine residents. Regulatory filings and the related notice identify names, employee identification numbers, Social Security numbers, bank account and routing numbers, tax identification numbers, passport or government-issued identification numbers, credit and debit account information, medical information, and health insurance information as data that may have been involved. The related complaint describes the affected population as approximately 10,000 employees and contractors and states that unauthorized access continued through August 22, 2025.
The Washington Post began sending written notices on November 12, 2025, and offered 12 months of identity protection services through IDX. The available filings do not establish a separate regulator-notification date, and information about affected data may vary by individual.