MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDCredentialsHighContained

National Board for Certified Counselors, Inc.

bd_ed724bb2b0de3c04 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 7, 2020

Filed

Jan 13, 2021

To disclose

18 weeks

Affected

8,521state residents only

Linked

10 filings

Confidence

63%

Full breach record for National Board for Certified Counselors, Inc. →

National Board for Certified Counselors, Inc. (NBCC) disclosed a cybersecurity incident occurring between August 31 and September 7, 2020. An unauthorized actor introduced malware that encrypted files and exfiltrated personal data, including names, addresses, Social Security numbers, dates of birth, and credential information. NBCC engaged third-party forensic investigators, notified the FBI, and offered 12 months of credit monitoring via TransUnion. The incident was discovered on September 7, 2020, and notification letters were issued in 2021.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due18 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 7 days

discovery → filing · 18 weeks / 128 days

Aug 31, 2020

Begins

Sep 7, 2020

Discovered

Jan 13, 2021

Filed

vs. sector median

on median

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Indiana State AGbd_1c897fa7e6e9d04f2021-01-12 · +1dVerified
Montana State AGbd_2c41a7e342598fe92021-01-12 · +1dCandidate
Maine State AGbd_3b308b49ee1b57412021-01-12 · +1dVerified
California State AGbd_3e380c527a1439a32021-01-12 · +1dVerified

Show 5 more filings ↓up to 12d gap

Washington State AGbd_8c92c2d72fb93b572021-01-12 · +1dVerified
Delaware State AGbd_af7418f535af96652021-01-12 · +1dVerified
Massachusetts State AGbd_f6a76ab1cbfb4dbb2021-01-12 · +1dVerified
New Hampshire State AGbd_28e4ee45da9290042021-01-21 · +8dVerified
Illinois State AGbd_e1132c683ae958112021-01-01 · +12dVerified

Name: National Board for Certified Counselors, Inc.
norm: national board for certified counselors

Name: National Board for Certified Counselors, Inc.
norm: national board for certified counselors
Industry: Professional Servicesllm

Discovered: Sep 7, 2020
Breach occurred: Aug 31, 2020 – Sep 7, 2020
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 8,521state-resident count only
Data types: Identity (basic)Government IDCredentials
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notifying regulatory authorities, as required by law

During the incident: Began working with third‐party forensic investigators
Notified the Federal Bureau of Investigation (“FBI”)
Offering twelve (12) months of complimentary access to credit monitoring and identity theft restoration services through TransUnion
Changes made: Reviewed our existing policies and procedures
Working to implement additional safeguards to further secure our information systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(128 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+11d

Montana State AG+11d

Maine State AG+11d

California State AG+11d

Washington State AG+11d

Delaware State AG+11d

Massachusetts State AG+11d

South Carolina State AG+12d · this page

New Hampshire State AG+20d

Pattern: first filing Jan 1 (IL), last Jan 21 (NH) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/NationalBoardCertifiedCounselors.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 13, 2021
Raw hash: 59ecb3623f60a3c799e0d6f62d2d69a6f5536899c3849a91551182c40844ecea

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityNational Board for Certified Counselors, Inc.

Victim entityNational Board for Certified Counselors, Inc.

Incidentdiscovered Sep 7, 2020

Stated responseBegan working with third‐party forensic investigators

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov