Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedFinancial accountHealth (basic)CredentialsLowResolved

Scholarship America, Inc.

bd_54ca1804df785868 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 28, 2020

Filed

Aug 4, 2020

To disclose

14 weeks

Affected

1state residents only

Linked

7 filings

Confidence

66%

Full breach record for Scholarship America, Inc. →3 incidents on file

Scholarship America, Inc. notified Montana regulators of a cybersecurity incident where unauthorized access to an email account exposed personal information, including financial/bank account numbers, medical history, and credentials. The incident was detected on April 28, 2020. The company engaged forensic experts, reset passwords, and provided two years of complimentary identity theft protection via NortonLifeLock.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 98 days

Apr 28, 2020

Discovered

Aug 4, 2020

Filed

vs. sector median

+7 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_aa19265be260b8492020-08-04Verified
Massachusetts State AGbd_131ada42e9939c052020-08-05 · +1dVerified
Indiana State AGbd_15bf293d154871742020-08-05 · +1dVerified
Massachusetts State AGbd_1c55b4236c5e32be2020-09-09 · +36dVerified

Show 2 more filings ↓up to 36d gap

New Hampshire State AGbd_3b43798d1cd5e1652020-09-09 · +36dVerified
Indiana State AGbd_65060d5855580bd32020-09-09 · +36dVerified

Name: Scholarship America, Inc.
norm: scholarship america

Name: Scholarship America, Inc.
norm: scholarship america
Industry: Educationllm

Discovered: Apr 28, 2020
Materiality determined: —
Notification sent: Jun 15, 2020
Affected individuals: 1state-resident count only
Data types: Financial accountHealth (basic)Credentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Providing notice to state regulators as required
Initial access: phishing_link

During the incident: Shutdown unauthorized access and remediate the problem
Brought in independent IT security and forensics experts to conduct a detailed system wide review
Working with law enforcement and sharing information for their investigation
Resetting passwords on all impacted accounts
Systemwide email password resets by all users
Activated enhanced monitoring of our IT systems
Hired a qualified third-party IT forensic expert to conduct an exhaustive investigation
Changes made: Working to implement additional safeguards and security measures to enhance the privacy and security of information in our systems
Retained NortonLifeLock, Inc. to provide two (2) years of complimentary LifeLock DefenderTM Preferred identity theft protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Washington State AGAug 4 · first

Montana State AGAug 4 · first · this page

Massachusetts State AG+1d

Indiana State AG+1d

Massachusetts State AG+36d

New Hampshire State AG+36d

Indiana State AG+36d

Pattern: first filing Aug 4 (WA), last Sep 9 (IN) — a 36-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Scholarship-America-Inc.-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2020
Raw hash: d50cf6875d8c205972899f0908362beed57b89714ff45fa0075449b2b4e8cc52

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityScholarship America, Inc.

Victim entityScholarship America, Inc.

Incidentdiscovered Apr 28, 2020

Stated responseShutdown unauthorized access and remediate the problem

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov