HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Homeschool Legal Defense Association

bd_3a799b687c7d12a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 2, 2022

Filed

Jan 30, 2023

To disclose

52 weeks

Affected

3state residents only

Linked

3 filings

Confidence

67%

Full breach record for Homeschool Legal Defense Association →2 incidents on file

Homeschool Legal Defense Association (HSLDA) notified affected individuals of a data security incident involving its payroll management system. An unauthorized party gained access using compromised credentials from a third-party service provider. HSLDA engaged forensic experts, secured the system, and offered 12 months of credit monitoring. The incident may have impacted employee personal data.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 52 weeks / 362 days

Feb 2, 2022

Discovered

Jan 30, 2023

Filed

vs. sector median

+33 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_53cf643f56b5efb32023-01-30Candidate
New Hampshire State AGbd_e22ee248b17509c92023-02-01 · +2dVerified

Name: Homeschool Legal Defense Association
norm: homeschool legal defense

Name: Homeschool Legal Defense Association
norm: homeschool legal defense
Industry: Professional Servicesllm

Discovered: Feb 2, 2022
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Shutting down access to the payroll system
Changing passwords
Engaging third party experts to assist in remediation steps
Commenced an investigation to determine the nature and scope of the incident
Engaged a third-party data mining vendor to conduct a further review
Changes made: Strengthening its internal password policy by increasing complexity
Enhancing secure login authentication procedures for third party service provider accounts
Arranged for you to enroll, at no cost to you, in an online credit monitoring service (1-Bureau Credit Watch Gold) for twelve (12) months provided by Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 52 weeks(362 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJan 30 · first

Montana State AGJan 30 · first · this page

New Hampshire State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-48.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2023
Raw hash: 4f619704b8b95acad138ddce3ac806f50bc458c86a50c5e8b76cc7da6a86401d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHomeschool Legal Defense Association

Victim entityHomeschool Legal Defense Association

Incidentdiscovered Feb 2, 2022

Stated responseShutting down access to the payroll system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov