Data Breach: ABA Reports 1.5 Million Member Accounts Hacked

The American Bar Association (ABA) announced that it has experienced a data breach, where hackers have infiltrated its network and accessed older login credentials for 1.5 million members.

This association is the world’s largest association of lawyers, notified its members of a data breach that occurred in March 2023. The breach may have exposed the login credentials of a legacy member system that was decommissioned in 2018. The ABA activated its incident response plan and hired cybersecurity experts to investigate the unusual network activity.

ABA has confirmed that an unauthorized third party gained access to its network in March 2023, potentially obtaining certain information. The breach impacted 1,466,000 members who used the old ABA website prior to 2018 or the ABA Career Center since 2018.

The ABA stated that no corporate or personal data was stolen, and the legacy credentials were hashed and salted for security. While the stolen credentials may pose a threat, there is no evidence of their abuse yet.

According to the notification sent to impacted members, the passwords compromised in the American Bar Association (ABA) breach were hashed and salted, meaning that random characters were added to the plaintext password and then converted into cybertext.

However, threat actors can still potentially dehash the passwords over time. Adding to the concern, the ABA states that “in many instances,” the password may have been a default password assigned by the ABA during registration if the account holder did not later change it.

ABA members are at risk of their current membership portal being breached as a result of using the same credentials for the new member system as the legacy system that was closed in 2018, which hackers breached in March 2023.

This poses a risk of unauthorized access to other accounts. To prevent further unauthorized access, the ABA advises its members to change their passwords on the site and on any other sites that use the same login credentials. Additionally, ABA members are warned to be vigilant of spear-phishing emails that impersonate the ABA, as threat actors may use them to obtain more personal information.