Penquis Data Breach Lawsuit Investigation
On February 5, 2026, community action agency Penquis disclosed a network security incident that may have exposed sensitive employee data. Individuals who received a breach notification letter can learn about their rights, available credit-monitoring services, and potential legal options below.
Action step: If you were notified, review the information on this page and consider speaking with a qualified data-privacy attorney about securing compensation and identity-theft protections.
Key Details at a Glance
- Entity involved: Penquis CAP (Penquis)
- Incident type: Unauthorized network access
- Discovery date: December 12, 2025
- Employee data identified in affected files: December 18, 2025
- Consumer notice mailed: January 30, 2026
- Data elements at risk: First and last name, Social Security number
- Free services offered: 12-month Cyberscout single-bureau credit monitoring, credit report, and credit score
What Happened
Penquis detected suspicious activity in its computer network on December 12, 2025 and immediately enlisted internal IT teams and third-party forensic specialists to investigate. Preliminary findings indicated certain files may have been accessed without authorization, and by December 18 Penquis determined those files contained employee information. Although the organization cannot confirm that any specific records were viewed or stolen, it issued notices to all employees out of an abundance of caution.
Download Official Breach Notice (PDF)Information Involved
The following personal identifiers were potentially exposed:
- First and last name
- Social Security number
Penquis’ Response
According to the notification filed with the Maine Attorney General, Penquis:
- Launched an internal investigation immediately after detecting suspicious activity.
- Engaged outside digital forensics specialists to determine the incident’s scope.
- Offered 12 months of complimentary Single Bureau Credit Monitoring/Report/Score services through Cyberscout (a TransUnion company).
- Provided guidance on additional steps individuals can take to protect against fraud and identity theft.
Steps You Can Take Now
If you received Penquis’s letter dated January 30, 2026, consider the following:
- Enroll in the free Cyberscout credit-monitoring package as soon as possible.
- Monitor bank, credit-card, and other financial statements for unfamiliar activity.
- Place a fraud alert or security freeze on credit files if you notice suspicious transactions.
- Retain all correspondence from Penquis; it may be needed for any future legal or insurance claims.
Company Overview
Penquis CAP (Penquis) is a nonprofit community action agency founded in 1967 and headquartered in Bangor, Maine. The organization provides housing, economic, and family support services across the region.
- Website: penquis.org
- Industry: Civic & Social Organization
- Employees: 501 – 1,000
- Headquarters: 262 Harlow Street, Bangor, Maine, United States
- Founded: 1967
- Social: X • Instagram • Facebook • YouTube
Frequently Asked Questions
I received a data breach letter from Penquis — what should I do?
Follow the activation instructions for the complimentary Cyberscout credit monitoring, review your financial accounts regularly, and consider consulting a data-privacy attorney about your legal rights.
How do I submit a claim related to the Penquis data breach?
Keep all Penquis correspondence and any evidence of fraud. An attorney can advise on possible claims for damages, credit-monitoring reimbursement, or participation in a future class action.
What information did the Penquis breach expose?
Penquis reported that first and last names and Social Security numbers stored in certain files were potentially at risk.
Did Penquis offer credit monitoring, and for how long?
Yes. Penquis is offering 12 months of Single Bureau Credit Monitoring, Credit Report, and Credit Score services at no cost through Cyberscout.
How can I get the official breach notice (PDF) for Penquis?
You can download the publicly filed notification directly from the Maine Attorney General’s website using the link above or the button labeled “Download Official Breach Notice (PDF).”
How many people were affected by the Penquis breach?
Penquis has not publicly disclosed the exact number of impacted employees in the filing available as of February 6, 2026.
