HackingStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTPIIMediumContained
National Student Clearinghouse
bd_b5e4fea795fb28f9 · schema v1 · pii pii-v1
Full breach record for National Student Clearinghouse →National Student Clearinghouse notified Vermont AG of a data breach involving its third-party provider, Progress Software's MOVEit Transfer tool. The incident, occurring around May 30, 2023, resulted in the exfiltration of personal information including names, DOBs, SSNs, and student records. The Clearinghouse patched the software, engaged forensic experts, and offered two years of identity monitoring.
Vermont clock✗ VT AG >45 bday13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 7 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 78 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (1)
- bd_cf3b44f0d9c611cdLeak Sitecl0pfiled 2023-06-14(78d gap)Verified by operator
Regulatory filings (5) · sorted by filing gap
- bd_2a4b3c8c4d73dde1Maine State AGfiled 2023-08-31Verified
- bd_b407d20f148d3694Montana State AGfiled 2023-08-31Candidate
- bd_116e7610d8f2a768Washington State AGfiled 2023-09-21(21d gap)Verified by operator
- bd_3c0bc77e712651d4California State AGfiled 2023-09-21(21d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 21d gap
- bd_f56f2ba4dc387770Oregon State AGfiled 2023-09-21(21d gap)Verified by operator
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-08-31-national-student-clearinghouse-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 31, 2023
- Raw hash
- cf51eecba107b64b5cd011b4da6f78a77bd392bc10d6879fd4f9bcdfa3792d24
Reporting entity
- Name
- National Student Clearinghousenorm: national student clearinghouse
- Domain
- studentclearinghouse.org
Victim entity
- Name
- National Student Clearinghousenorm: national student clearinghouse
- Domain
- studentclearinghouse.org
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Aug 31, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- coordinated with law enforcement
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 13 weeks(92 days from discovery to filing)
- Compliance flags
- VT AG >45 bdayLeak >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.