HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTEDUCATIONMediumContained
National Student Clearinghouse
bd_c5625c0a94dc7f2e · schema v1 · pii pii-v1
Full breach record for National Student Clearinghouse →National Student Clearinghouse notified individuals of a data breach involving its third-party software provider, Progress Software, and its MOVEit Transfer solution. An unauthorized party obtained files containing personal information (name, DOB, contact info, SSN, student ID, school records) on or around May 30, 2023. The Clearinghouse was informed on May 31, 2023, and confirmed exfiltration on June 20, 2023. The organization engaged cybersecurity experts, coordinated with law enforcement, patched the software, and offered two years of identity monitoring.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_8ac0fc71a5cf7b94Maine State AGfiled 2023-12-15(3d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-577820
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 12, 2023
- Raw hash
- 05c80a9dd0e0a72989e1a909fc51efff7a22c3e1254b68bf9139436fc7f277c3
Reporting entity
- Name
- National Student Clearinghousenorm: national student clearinghouse
- Domain
- studentclearinghouse.org
Victim entity
- Name
- National Student Clearinghousenorm: national student clearinghouse
- Domain
- studentclearinghouse.org
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTEDUCATION
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Coordinated with law enforcement
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 28 weeks(195 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.