The National Board for Certified Counselors ("NBCC") was impacted by malware which prevented access to certain files on the system. The compromised information included name, address, Social Security number, date of birth, and credential information. NBCC hired third-party forensic investigators and the Federal Bureau of Investigation to investigate the incident and secure its systems, and notify potentially affected individuals. NBCC notified regulatory authorities and also provided those whose personal information was exposed by this incident with access to complimentary credit monitoring services through TransUnion.

The National Board for Certified Counselors, Inc. (NBCC) experienced a malware-driven cyberattack between August 31, 2020, and September 7, 2020, leading to a data breach reported on January 12, 2021. The incident compromised sensitive personal information of 9,898 Washington residents, including names, Social Security numbers, full dates of birth, and credential details. The breach stemmed from a cyberattack involving malware, which infiltrated NBCC’s systems, allowing unauthorized access to highly confidential data. The exposed information—particularly Social Security numbers and birth dates—poses severe risks, including identity theft, financial fraud, and long-term reputational harm to affected individuals. Given the nature of the compromised data, the breach falls under a high-severity category, as it directly impacts individuals' financial and personal security. The Washington State Office of the Attorney General disclosed the incident, emphasizing the potential for fraudulent misuse of the stolen credentials. While the exact method of malware deployment remains undisclosed, the breach underscores vulnerabilities in NBCC’s cybersecurity defenses, raising concerns about data protection compliance and the organization’s ability to safeguard sensitive client information.