HackingEducationProfessional ServicesEducationStolen CredentialsSkimmerTargetedData ExfiltratedIdentity (basic)Financial accountLowContained

National Catholic Educational Association

bd_b56c374b38c244aa · schema v1 · pii pii-v1

Severity

Low

Discovered

May 13, 2020

Filed

Jul 22, 2020

To disclose

10 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for National Catholic Educational Association →

National Catholic Educational Association (NCEA) notified the NH AG of a security incident where an unknown individual exploited a vulnerability in its iMIS management software to install a credit card skimmer between April 10 and May 18, 2020. NCEA discovered the vulnerability on May 13, 2020, patched the software, and identified one NH resident potentially impacted. NCEA is offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 33 days

discovery → filing · 10 weeks / 70 days

Apr 10, 2020

Begins

May 13, 2020

Discovered

Jul 22, 2020

Filed

vs. sector median

+1 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_83465c97b1d177082020-07-09 · +13dCandidate
Indiana State AGbd_ae6a43087b7a43192020-07-09 · +13dVerified

Name: National Catholic Educational Association
norm: national catholic educational

Name: National Catholic Educational Association
norm: national catholic educational
Industry: EducationllmProfessional Servicesllm

Discovered: May 13, 2020
Breach occurred: Apr 10, 2020 – May 18, 2020
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of Attorney General
Initial access: exploit_public_facing

During the incident: Updated iMIS to remove the vulnerability
Began investigating the vulnerability
Notifying affected individuals
Offering complimentary credit monitoring and identity restoration services
Changes made: Removed the vulnerability and malicious code from iMIS software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 9 · first

Indiana State AGJul 9 · first

New Hampshire State AG+13d · this page

Pattern: first filing Jul 9 (MA), last Jul 22 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/national-catholic-educational-association-20200722.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2020
Raw hash: 419084ba8a56e6d8635ccb418a843f7115a2353e285d1c971936fd2c21c6eb43

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNational Catholic Educational Association

Victim entityNational Catholic Educational Association

Incidentdiscovered May 13, 2020

Stated responseUpdated iMIS to remove the vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov