HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedGovernment IDPIIMediumResolved

National Education Association

bd_58e493e9fdba0b7c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2020

Filed

Oct 19, 2020

To disclose

18 days

Affected · nationwide

6291 in this filing

Linked

3 filings

Confidence

66%

Full breach record for National Education Association →4 incidents on file

The National Education Association experienced an external system breach (hacking) on October 1, 2020. The incident compromised the names and Social Security Numbers of 629 individuals, including one Maine resident. The Association notified affected individuals in writing on October 16, 2020, and provided 18 months of credit monitoring through CyberScout.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 1, 2020 → Filed with AG Oct 19, 202018d ✓ ME AG ≤30d18 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 18 days

Oct 1, 2020

Begins

Oct 1, 2020

Discovered

Oct 19, 2020

Filed

vs. sector median

16 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_f8b52751af2b838d2020-10-19Verified
Montana State AGbd_27c0fed81501413d2020-10-16 · +3dCandidate

Name: National Education Association
norm: national education
Domain: nea.org

Name: National Education Association
norm: national education
Domain: nea.org
Industry: Professional Servicesllm

Discovered: Oct 1, 2020
Breach occurred: Oct 1, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 16, 2020
Affected individuals: 629state + nationwide
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 18 months of CyberScout credit monitoring and dark web monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: ME AG ≤30d · 18d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 1, 2020
→ Filed with AG: Oct 19, 2020
18d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 1, 2020 → Filed with AG: Oct 19, 2020	18d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGOct 16 · first

New Hampshire State AG+3d

Maine State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/07f7ffcc-796a-4615-8aa5-ee3f5a83f951.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 19, 2020
Raw hash: 7b703dc9997fb5006ba5f050c90f65c04529d80db1035bbc98a13a6b39493b3b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNational Education Association

Victim entityNational Education Association

Incidentdiscovered Oct 1, 2020

Stated responseSent written notification to affected individuals

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov