MalwareProfessional ServicesProfessional ServicesRansomwareStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

National Board for Certified Counselors, Inc.

bd_3e380c527a1439a3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 7, 2020

Filed

Jan 12, 2021

To disclose

18 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

64%

Full breach record for National Board for Certified Counselors, Inc. →

National Board for Certified Counselors, Inc. (NBCC) experienced a malware incident between August 31 and September 7, 2020. The malware prevented access to certain files, and an unauthorized actor accessed and acquired files containing names, addresses, Social Security numbers, dates of birth, and credential information. NBCC engaged forensic investigators and notified the FBI. Affected individuals are offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 18 weeks / 127 days

Aug 31, 2020

Begins

Sep 7, 2020

Discovered

Jan 12, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_1c897fa7e6e9d04f2021-01-12Verified
Montana State AGbd_2c41a7e342598fe92021-01-12Candidate
Maine State AGbd_3b308b49ee1b57412021-01-12Verified
Washington State AGbd_8c92c2d72fb93b572021-01-12Verified

Show 5 more filings ↓up to 11d gap

Delaware State AGbd_af7418f535af96652021-01-12Verified
Massachusetts State AGbd_f6a76ab1cbfb4dbb2021-01-12Verified
South Carolina State AGbd_ed724bb2b0de3c042021-01-13 · +1dVerified
New Hampshire State AGbd_28e4ee45da9290042021-01-21 · +9dVerified
Illinois State AGbd_e1132c683ae958112021-01-01 · +11dVerified

Name: National Board for Certified Counselors, Inc.
norm: national board for certified counselors

Name: National Board for Certified Counselors, Inc.
norm: national board for certified counselors
Industry: Professional Servicesllm

Discovered: Sep 7, 2020
Breach occurred: Aug 31, 2020 – Sep 7, 2020
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation (FBI)Notifying regulatory authorities, as required by law

During the incident: Began working with third-party forensic investigators to investigate the nature and scope of the event
Notified the Federal Bureau of Investigation (FBI) and is assisting in the FBI’s investigation
Offering twelve (12) months of complimentary access to credit monitoring and identity theft restoration services through TransUnion
Changes made: Reviewed existing policies and procedures
Working to implement additional safeguards to further secure information systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(127 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+11d

Montana State AG+11d

Maine State AG+11d

Washington State AG+11d

Delaware State AG+11d

Massachusetts State AG+11d

California State AG+11d · this page

South Carolina State AG+12d

New Hampshire State AG+20d

Pattern: first filing Jan 1 (IL), last Jan 21 (NH) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-198460
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2021
Raw hash: 4b4b46456d2297896cf7f97fd2cbc5e77154c5c1b43857df81f224de35b77edf

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityNational Board for Certified Counselors, Inc.

Victim entityNational Board for Certified Counselors, Inc.

Incidentdiscovered Sep 7, 2020

Stated responseBegan working with third-party forensic investigators to investigate the nature and scope of the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov