In a mandatory notice filed with the state of Maine, the organization said the breach was uncovered in August after happening in February.
The team said it has started contacting those affected to offer them free credit monitoring and identity theft protection.