Strange to not see an official statement and post Mortem from Stripe mentioned anywhere. Can someone who got a letter post a (redacted as necessary) scan of it?
https://ago.vermont.gov/blog/category/security-breaches/
There's 63 pages.
University of Notice of Data Breach to Consumers
https://ago.vermont.gov/blog/2019/10/02/university-of-notice...
Looks like it was the vendor ‘Legalinc’.