HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTPIIMediumContained
National Student Clearinghouse
bd_e40ce7006cdba8e6 · schema v1 · pii pii-v1
Full breach record for National Student Clearinghouse →National Student Clearinghouse notified Delaware AG of a breach involving its third-party provider, Progress Software's MOVEit Transfer solution. The incident occurred around May 30, 2023, when an unauthorized party accessed files containing names, DOBs, SSNs, and student records. The Clearinghouse patched the software, engaged forensic experts, coordinated with law enforcement, and offered two years of free identity monitoring.
Leak gap clock⏱ Leak >30d13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
A leak claim by cl0p about this victim predates this filing by 77 days.View originating leak claim
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/10/National-Student-Clearing-House-Sample-Individual-Notification-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 30, 2023
- Raw hash
- 3a524ace57b61263e0f61dee17a141865d948ba9101402fd5fa78bfcb59dcf42
Reporting entity
- Name
- National Student Clearinghousenorm: national student clearinghouse
- Domain
- studentclearinghouse.org
Victim entity
- Name
- National Student Clearinghousenorm: national student clearinghouse
- Domain
- studentclearinghouse.org
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- coordinated with law enforcement
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 13 weeks(91 days from discovery to filing)
- Compliance flags
- Leak >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.