https://ago.vermont.gov/blog/category/security-breaches/
There's 63 pages.
University of Notice of Data Breach to Consumers
https://ago.vermont.gov/blog/2019/10/02/university-of-notice...
Looks like it was the vendor ‘Legalinc’.