HackingEducationEducationStolen CredentialsEmail MisuseData ExfiltratedCustomer Data InvolvedCredentialsEducationFinancial accountHealth (basic)Identity (basic)Government IDHighContained

Scholarship America, Inc.

bd_aa19265be260b849 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 28, 2020

Filed

Aug 4, 2020

To disclose

14 weeks

Affected

2,620state residents only

Linked

7 filings

Confidence

68%

Full breach record for Scholarship America, Inc. →3 incidents on file

Scholarship America, Inc. notified the Washington AG of a data breach discovered on April 28, 2020. Unauthorized access to email accounts resulted in the exfiltration of PII, including names, DOBs, and financial/medical data, affecting 2,620 Washington residents. The company engaged forensic experts, reset credentials, and provided 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d14 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 14 weeks / 98 days

Apr 28, 2020

Discovered

Aug 4, 2020

Filed

vs. sector median

+7 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_54ca1804df7858682020-08-04Candidate
Massachusetts State AGbd_131ada42e9939c052020-08-05 · +1dVerified
Indiana State AGbd_15bf293d154871742020-08-05 · +1dVerified
Massachusetts State AGbd_1c55b4236c5e32be2020-09-09 · +36dVerified

Show 2 more filings ↓up to 36d gap

New Hampshire State AGbd_3b43798d1cd5e1652020-09-09 · +36dVerified
Indiana State AGbd_65060d5855580bd32020-09-09 · +36dVerified

Name: FisherBroyles LLP
norm: fisherbroyles

Name: Scholarship America, Inc.
norm: scholarship america
Industry: Educationllm

Discovered: Apr 28, 2020
Materiality determined: —
Notification sent: Aug 5, 2020
Affected individuals: 2,620state-resident count only
Data types: CredentialsEducationFinancial accountHealth (basic)Identity (basic)Government ID
Data elements: NameDate of birthStudent ID number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Office of the Attorney General
Initial access: valid_credentials

During the incident: Resetting passwords on all impacted email accounts
Forced a systemwide email password reset for all users
Disabled used protocols
Activated enhanced monitoring of SAI IT systems by SAI’s managed detection and response service provider
Retained independent IT security and forensics experts
Engaged with the FBI to assist in a federal law enforcement investigation
Conducted a detailed systemwide investigation
Retained NortonLifeLock to provide notifications and identity theft protection services
Changes made: Changed and strengthened all passwords
Disabled unused protocols
Enhanced monitoring through Managed Detection and Response vendor
Implemented Multi Factor Authentication on privileged accounts
Removed access to email web portal
Reviewed Microsoft Office 365 security settings to assure settings meet best practices
Reviewed security settings with email security vendor
Reviewed security settings with end point detection and response vendor
Threat Management – changed anti-phishing default policy
SharePoint sharing policies restricted
Updated Microsoft Teams settings
Restricted Microsoft Forms external use
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Montana State AGAug 4 · first

Washington State AGAug 4 · first · this page

Massachusetts State AG+1d

Indiana State AG+1d

Massachusetts State AG+36d

New Hampshire State AG+36d

Indiana State AG+36d

Pattern: first filing Aug 4 (MT), last Sep 9 (IN) — a 36-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10210.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2020
Raw hash: c6f7aa4a7e2d72b81ed282fab02cf8975400d7e41e660ede1d3a0fb0ee8412d5

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityFisherBroyles LLP

Victim entityScholarship America, Inc.

Incidentdiscovered Apr 28, 2020

Stated responseResetting passwords on all impacted email accounts

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com