HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedAuthenticationCredentialsMediumContained

American Bar Association

bd_1919aeff1b67bdfc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 17, 2023

Filed

Apr 21, 2023

To disclose

5 weeks

Affected

27,736state residents only

Linked

5 filings

Confidence

70%

Full breach record for American Bar Association →2 incidents on file

American Bar Association notified Washington AG of a cyberattack where an unauthorized third party gained access to its network between March 6 and March 20, 2023. The incident, discovered on March 17, 2023, compromised usernames and hashed/salted passwords for accounts on the old ABA website and Career Center. 27,736 Washington residents were affected.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 11 days

discovery → filing · 5 weeks / 35 days

Mar 6, 2023

Begins

Mar 17, 2023

Discovered

Apr 21, 2023

Filed

vs. sector median

13 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_9b4a53df43e28d252023-04-21Verified
California State AGbd_a594d6029eaa462f2023-04-20 · +1dCandidate
Delaware State AGbd_ebe4be8808814e122023-04-20 · +1dCandidate
South Carolina State AGbd_0e092f7ea0dad5762024-06-10 · +416dVerified

Name: American Bar Association
norm: american bar
Domain: americanbar.org

Name: American Bar Association
norm: american bar
Domain: americanbar.org
Industry: Professional Servicesllm

Discovered: Mar 17, 2023
Breach occurred: Mar 6, 2023 – Mar 20, 2023
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 27,736state-resident count only
Data types: Credentials
Data elements: Username + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: The incident response plan was immediately activated response
Cybersecurity experts were retained to assist with the investigation
Removing the unauthorized third party from the ABA network
Reviewing network security configurations to address continually evolving cyber threats
Changes made: Reviewing network security configurations to address continually evolving cyber threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGApr 20 · first

Delaware State AGApr 20 · first

Oregon State AG+1d

Washington State AG+1d · this page

South Carolina State AG+417d

Pattern: first filing Apr 20 (CA), last Jun 10 (SC) — a 417-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA21860.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2023
Raw hash: 6a0982161765268f91d7a81c03c1c9dd80535205da08a8bffd0fb774600feb91

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAmerican Bar Association

Victim entityAmerican Bar Association

Incidentdiscovered Mar 17, 2023

Stated responseThe incident response plan was immediately activated response

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com