Notification of Data Security Incident

September 25, 2026 – Penquis CAP (“Penquis”) has become aware of a data security incident that may have impacted information belonging to certain individuals. Penquis is not aware of any evidence to suggest that any information has been misused.

On December 12, 2025, Penquis discovered potentially suspicious activity in its network. Upon discovery, Penquis immediately began working with its I.T. team and third-party forensic specialists to investigate the full nature and scope of the incident. Based on the investigation, it was determined that certain files may have been subject to unauthorized access as part of this incident. As a result, together with third-party specialists, Penquis began a comprehensive and time-consuming review of the potentially impacted files to determine the type of information contained therein and to whom that information related. The comprehensive and time-consuming review process was completed on September 15, 2026.

At that time, Penquis discovered that the affected files may contain personally identifiable information (“PII”) and protected health information (“PHI”). The information contained in the affected data set may include a first and last name, in combination with one or more of the following: date of birth, Social Security number, driver's license or state identification number, account number, routing number, health insurance information, and/or various types of medical information such as mental or physical condition, diagnosis and treatment information, prescription information, dates of service, and medical record number.

At this time, Penquis is not aware of any evidence to suggest that any information has been fraudulently misused. However, in an abundance of caution, Penquis is notifying potentially impacted individuals of this incident. Although Penquis has no reason to believe any individual’s information has been or will be misused as a result of this incident, individuals are nonetheless encouraged to monitor their account statements and explanation of benefits forms for suspicious activity and to detect errors.

Penquis has established a toll-free number to answer questions about the incident and to address related concerns. The number to call is 1-844-770-4095 between 8:00 am and 8:00 pm EST, excluding holidays. You may also write to Penquis at Attn: Compliance, 262 Harlow Street, Bangor, ME 04402.

Penquis takes the privacy and security of the information in its care seriously and sincerely regrets any worry or inconvenience this incident may have caused.

What steps can I take to protect my private information?

• We encourage you to remain vigilant against incidents of identity theft and fraud by reviewing your credit reports/account statements and explanation of benefits forms for suspicious activity and to detect errors. If you detect suspicious activity on any of your accounts, you should promptly notify the financial institution or company with which the account is maintained. You should also report any fraudulent activity or any suspected incidents of identity theft to law enforcement.
• You may obtain a copy of your credit report at no cost from each of the three nationwide credit reporting agencies. To do so, visit www.annualcreditreport.com or call toll free at 1-877-322-8228. Contact information for the three agencies appears at the bottom of this page.
• You can take steps recommended by the Federal Trade Commission to protect yourself from identify theft. The FTC’s website offers helpful information at www.ftc.gov/idtheft.

How do I obtain a copy of my credit report?

You can obtain a copy of your credit report, free of charge, directly from each of the three nationwide credit reporting agencies once every twelve (12) months. To do so, please visit www.annualcreditreport.com or call toll free at 1-877-322-8228. Contact information for the three agencies is included in the notification letter and is also listed at the bottom of this page.

How do I put a fraud alert on my account?

A fraud alert informs creditors of possible fraudulent activity within your report and requests that creditors contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact Equifax, Experian or TransUnion and follow the Fraud Victims instructions. To place a fraud alert on your credit accounts, contact your financial institution or credit provider. Contact information for the three nationwide credit reporting agencies is listed below.

Contact information for the three nationwide credit reporting agencies is as follows:

Additional Information

You can further educate yourself regarding identity theft, fraud alerts, credit freezes, and the steps you can take to protect your personal information by contacting the credit reporting bureaus, the Federal Trade Commission (FTC), or your state Attorney General. The FTC also encourages those who discover that their information has been misused to file a complaint with them. The FTC may be reached at 600 Pennsylvania Ave. NW, Washington, D.C. 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261.

You have the right to file a police report if you ever experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement, your state Attorney General, and the FTC. This notice has not been delayed by law enforcement.