Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Association for Supervision and Curriculum Development (ASCD)

bd_ffdd290103b49854 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 21, 2018

Filed

Feb 27, 2018

To disclose

6 days

Affected

1state residents only

Confidence

66%

Full breach record for Association for Supervision and Curriculum Development (ASCD) →

ASCD disclosed a spear-phishing attack discovered on Feb 21, 2018, resulting in unauthorized access to employee W-2 forms containing names, addresses, and SSNs. The organization notified the IRS and FBI, retained legal counsel, and provided two years of free credit monitoring. No specific count of affected individuals was disclosed in this filing.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 days

Feb 21, 2018

Discovered

Feb 27, 2018

Filed

vs. sector median

17 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Association for Supervision and Curriculum Development (ASCD)
norm: association for supervision and curriculum development ascd
Domain: ascd.org

Name: Association for Supervision and Curriculum Development (ASCD)
norm: association for supervision and curriculum development ascd
Domain: ascd.org
Industry: Professional Servicesllm

Discovered: Feb 21, 2018
Materiality determined: —
Notification sent: Feb 22, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: contacting appropriate law enforcement, including the Internal Revenue Servicenotifying the IRS and FBI
Initial access: phishing_link

During the incident: Commenced an investigation
Contacting appropriate law enforcement, including the Internal Revenue Service
Working with our IT department to assist with our investigation and remediation
Retained the services of an attorney who specializes in cyber-attacks
Notifying the IRS and FBI
Arranging to provide credit monitoring and related services for two years at no cost
Changes made: Enacting additional measures to ensure similar incidents will not happen in the future
Continuously review our systems and make improvements, as needed, to minimize the chances of this happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Association-for-Supervision-and-Curriculum-Development-ASCD.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2018
Raw hash: 1cfbb5f3ebe729fd3b1a7199691a586edf04c85e3b82490102aac2410432ea35

Reporting entityAssociation for Supervision and Curriculum Development (ASCD)

Victim entityAssociation for Supervision and Curriculum Development (ASCD)

Incidentdiscovered Feb 21, 2018

Stated responseCommenced an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov