MalwareProfessional ServicesProfessional ServicesRansomwareCapture Stored DataData ExfiltratedData EncryptedTargetedIdentity (basic)Government IDCredentialsHighActive

National Board for Certified Counselors, Inc.

bd_8c92c2d72fb93b57 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 7, 2020

Filed

Jan 12, 2021

To disclose

18 weeks

Affected

9,898state residents only

Linked

10 filings

Confidence

70%

Full breach record for National Board for Certified Counselors, Inc. →

National Board for Certified Counselors, Inc. (NBCC) reported a cyberattack in Washington affecting 9,898 residents. Unauthorized access occurred Aug 31–Sep 7, 2020, involving malware that encrypted files and exfiltrated data including names, SSNs, DOBs, and credentials. NBCC engaged forensic investigators, notified the FBI, and began notifying individuals on Jan 12, 2021.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d18 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 18 weeks / 127 days

Aug 31, 2020

Begins

Sep 7, 2020

Discovered

Jan 12, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_1c897fa7e6e9d04f2021-01-12Verified
Montana State AGbd_2c41a7e342598fe92021-01-12Candidate
Maine State AGbd_3b308b49ee1b57412021-01-12Verified
California State AGbd_3e380c527a1439a32021-01-12Verified

Show 5 more filings ↓up to 11d gap

Delaware State AGbd_af7418f535af96652021-01-12Verified
Massachusetts State AGbd_f6a76ab1cbfb4dbb2021-01-12Verified
South Carolina State AGbd_ed724bb2b0de3c042021-01-13 · +1dVerified
New Hampshire State AGbd_28e4ee45da9290042021-01-21 · +9dVerified
Illinois State AGbd_e1132c683ae958112021-01-01 · +11dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: National Board for Certified Counselors, Inc.
norm: national board for certified counselors
Industry: Professional Servicesllm

Discovered: Sep 7, 2020
Breach occurred: Aug 31, 2020 – Sep 7, 2020
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 12, 2021
Affected individuals: 9,898state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation (“FBI”)Notified Washington Office of the Attorney General

During the incident: Began working with third-party forensic investigators to investigate the nature and scope of the event
Notified the Federal Bureau of Investigation (“FBI”)
Began providing written notice of this incident to potentially affected individuals
Posted notice of this event on its website
Issued a press release nationwide
Changes made: Working to implement additional safeguards and training to its employees
Offering twelve (12) months of complimentary access to credit monitoring services for twelve (12) months through TransUnion
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(127 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+11d

Montana State AG+11d

Maine State AG+11d

California State AG+11d

Delaware State AG+11d

Massachusetts State AG+11d

Washington State AG+11d · this page

South Carolina State AG+12d

New Hampshire State AG+20d

Pattern: first filing Jan 1 (IL), last Jan 21 (NH) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10388.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2021
Raw hash: af995253ca20b9e110959eae460f12ed179224045c31b3222249da1ccf51fd1e

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityNational Board for Certified Counselors, Inc.

Incidentdiscovered Sep 7, 2020

Stated responseBegan working with third-party forensic investigators to investigate the nature and scope of the event

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com