MRA—The Management Association Inc., a nonprofit organization, agreed to pay $775,000 to settle a class-action lawsuit filed by an employee of one of its clients after a data breach exposed the personal information of roughly 36,000 individuals. The compromised data belonged to employees of the nonprofit’s clients, leading to potential risks such as identity theft or financial fraud. The settlement offers affected class members a pro rata cash benefit, unless they opt out. Following the incident, MRA implemented enhanced cybersecurity measures to prevent future breaches. The case was reviewed in the US District Court for the Eastern District of Wisconsin, where preliminary approval was granted. The breach highlights vulnerabilities in handling third-party employee data and underscores the financial and reputational repercussions of inadequate data protection.

The Vermont Office of the Attorney General disclosed that MRA suffered a network disruption on July 29, 2023, leading to unauthorized access to sensitive information. While the exact scope of the breach—including the number of affected individuals and the types of compromised data—remains undisclosed, the incident suggests potential exposure of business and consumer data. The breach was confirmed internally on June 11, 2024, with consumer notifications issued on June 28, 2024, indicating a delayed response that may have exacerbated risks. The lack of transparency regarding the compromised data (e.g., financial records, personal identifiers, or proprietary business information) raises concerns about reputational damage, financial fraud risks for affected parties, and possible regulatory scrutiny. The incident aligns with patterns of cyber intrusions targeting third-party vendors, where attackers exploit network vulnerabilities to exfiltrate data over prolonged periods.

The Maine Office of the Attorney General reported a data breach involving MRA - The Management Association on May 10, 2024. The breach occurred between June 30, 2023, and July 29, 2023, due to a ransomware attack, affecting 3,477 individuals in total, including 1 resident of Rhode Island. The compromised information included Social Security Numbers, and identity theft protection services were offered for 12 months.