HackingProfessional ServicesProfessional ServicesTargetedCredentialsMediumContained

American Bar Association

bd_0e092f7ea0dad576 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 17, 2023

Filed

Jun 10, 2024

To disclose

15 months

Affected

28,021state residents only

Linked

5 filings

Confidence

64%

Full breach record for American Bar Association →2 incidents on file

The American Bar Association notified individuals of a data breach where an unauthorized third party gained access to its network starting March 6, 2023. The incident exposed usernames and hashed, salted passwords for accounts on the old ABA website (pre-2018) and the ABA Career Center (post-2018). The ABA activated its incident response plan, retained cybersecurity experts, and removed the intruder. No plain-text passwords were exposed.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due15 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 11 days

discovery → filing · 15 months / 451 days

Mar 6, 2023

Begins

Mar 17, 2023

Discovered

Jun 10, 2024

Filed

vs. sector median

+46 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_1919aeff1b67bdfc2023-04-21 · +416dVerified
Oregon State AGbd_9b4a53df43e28d252023-04-21 · +416dVerified
California State AGbd_a594d6029eaa462f2023-04-20 · +417dCandidate
Delaware State AGbd_ebe4be8808814e122023-04-20 · +417dCandidate

Name: American Bar Association
norm: american bar
Domain: americanbar.org

Name: American Bar Association
norm: american bar
Domain: americanbar.org
Industry: Professional Servicesllm

Discovered: Mar 17, 2023
Breach occurred: Mar 6, 2023
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 10, 2024
Affected individuals: 28,021state-resident count only
Data types: Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Incident response plan was immediately activated
Cybersecurity experts were retained to assist with the investigation
Removed the unauthorized third party from the ABA network
Reviewed network security configurations to address continually evolving cyber threats
Changes made: Reviewed network security configurations to address continually evolving cyber threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(451 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGApr 20 · first

Delaware State AGApr 20 · first

Washington State AG+1d

Oregon State AG+1d

South Carolina State AG+417d · this page

Pattern: first filing Apr 20 (CA), last Jun 10 (SC) — a 417-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TheAmericanBarAssociation.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2024
Raw hash: 66b26fdc6a313f79700cd47fec915fdb00ae4db4c7fce02a2937e00f4e171ac6

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAmerican Bar Association

Victim entityAmerican Bar Association

Incidentdiscovered Mar 17, 2023

Stated responseIncident response plan was immediately activated

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov