About Appalachian Regional Commission
The Appalachian Regional Commission (ARC) is a partnership entity between the U.S. federal government and 13 state governments, focused on strengthening economic growth in the Appalachian Region. Recently, ARC experienced a data breach affecting 937 individuals, including one resident of Maine. The breach involved unauthorized access to ARC’s systems, resulting in the exposure of sensitive personal information. This incident has prompted ARC to take steps to notify affected individuals and provide resources for protection.
What Happened
On April 10, 2025, ARC became aware of a cybersecurity incident that involved the deployment of malware on certain systems. Upon detection, ARC took steps to contain the threat and engaged a third-party forensic firm to investigate the incident and assist with remediation efforts. ARC subsequently determined that an unauthorized party was able to access and remove some data from its network on April 10, 2025. Based on the comprehensive data analysis that was performed and ultimately completed on July 7, 2025, it appears that your personal information may have been involved.
The breach occurred on April 10, 2025, and ARC discovered it on July 7, 2025. It involved unauthorized access and data removal, affecting 937 individuals by exposing their personal information.
Next Steps
Affected individuals are encouraged to enroll in the provided complimentary credit monitoring services to safeguard their personal information. ARC has sent written notifications to those impacted, outlining the steps they can take to protect themselves from potential identity theft. Users should remain vigilant by closely reviewing their credit reports and account statements for any unusual activity. Any suspicious transactions should be reported promptly to the respective financial institutions.
Identity Theft Protection Services
Impacted individuals are offered 24 months of complimentary credit monitoring and identity theft protection services through IDX. These services include credit monitoring to alert users of any suspicious activity on their accounts. Affected individuals are encouraged to activate these services by October 15, 2025, using the provided enrollment code. Detailed instructions on how to enroll have been included in the notification letter to ensure that individuals can take full advantage of the protections offered.