On December 3, 2021, the Maine Office of the Attorney General disclosed a data breach at the American Council for International Studies (ACIS), discovered on June 10, 2021. The incident stemmed from an external malware attack, compromising the personal information of 42,430 individuals, including names and Social Security numbers, with 139 Maine residents directly affected. The breach exposed sensitive data, heightening risks of identity theft and financial fraud. In response, ACIS provided 12 months of credit monitoring and identity restoration services via Experian to impacted individuals. The attack’s scale and the nature of the leaked data personally identifiable information (PII) without ransomware involvement underscore significant reputational and operational risks for the organization. While no immediate financial losses or systemic disruptions were reported, the exposure of Social Security numbers elevates the long-term threat to affected individuals, potentially leading to fraudulent activities or misuse of their identities. The incident highlights vulnerabilities in ACIS’s cybersecurity defenses, particularly against external malware intrusions, and raises concerns about the adequacy of preventive measures for safeguarding sensitive participant data in educational and exchange programs.
TPRM report: https://www.rankiteo.com/company/american-councils-for-international-education
"id": "ame211090725",
"linkid": "american-councils-for-international-education",
"type": "Cyber Attack",
"date": "5/2021",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '42,430 (139 Maine residents)',
'industry': 'Education / International Studies',
'name': 'American Council for International Studies '
'(ACIS)',
'type': 'Non-profit Organization'}],
'attack_vector': 'Malware',
'customer_advisories': '12 months of credit monitoring and identity '
'restoration services offered via Experian',
'data_breach': {'number_of_records_exposed': '42,430',
'personally_identifiable_information': ['Names',
'Social Security '
'numbers'],
'sensitivity_of_data': 'High (includes Social Security '
'numbers)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)']},
'date_detected': '2021-06-10',
'date_publicly_disclosed': '2021-12-03',
'description': 'On December 3, 2021, the Maine Office of the Attorney General '
'reported a data breach involving the American Council for '
'International Studies (ACIS), discovered on June 10, 2021. '
'The breach, caused by an external malware attack, potentially '
'impacted the personal information of 42,430 individuals, '
'including names and Social Security numbers, with 139 Maine '
'residents specifically affected. ACIS offered 12 months of '
'credit monitoring and identity restoration services through '
'Experian to those potentially impacted.',
'impact': {'data_compromised': ['Names', 'Social Security numbers'],
'identity_theft_risk': 'High (PII exposed)'},
'references': [{'source': 'Maine Office of the Attorney General'}],
'regulatory_compliance': {'regulatory_notifications': 'Maine Office of the '
'Attorney General'},
'response': {'communication_strategy': 'Public disclosure via Maine Office of '
'the Attorney General; offer of credit '
'monitoring to affected individuals',
'third_party_assistance': 'Experian (credit monitoring and '
'identity restoration services)'},
'title': 'Data Breach at American Council for International Studies (ACIS)',
'type': 'Data Breach'}