American Bar Association data breach hits 1.4 million members

The American Bar Association (ABA) has suffered a data breach after hackers compromised its network and gained access to older credentials for 1,466,000 members.

The ABA is the largest association of lawyers and legal professionals globally, with 166,000 members as of 2022. The organization provides continuing education and services for lawyers and judges, as well as initiatives to improve the legal system in the USA.

Thursday night, the ABA began notifying members that a hacker was detected on its network on March 17th, 2023, and may have gained access to members' login credentials for a legacy member system decommissioned in 2018.

"On March 17, 2023, the ABA observed unusual activity on its network. The incident response plan was immediately activated response, and cybersecurity experts were retained to assist with the investigation," warns a notification email sent to impacted members and seen by BleepingComputer.

"The investigation determined that an unauthorized third party gained access to the ABA network beginning on or about March 6, 2023 and may have acquired certain information."

"On March 23, 2023, the investigation identified that an unauthorized third party acquired usernames and hashed and salted passwords that you may have used to access online accounts on the old ABA website prior to 2018 or the ABA Career Center since 2018."

BleepingComputer was told by the ABA that 1,466,000 members were affected by this breach.

While BleepingComputer has learned that this was not a ransomware attack and that no corporate or personal data was stolen, there are some concerns that the threat actors could abuse the credentials.

The American Bar Association says these legacy credentials were hashed and salted, meaning they were converted from plaintext into a more secure format.

"They were instead both hashed and salted, which is a process by which random characters are added to the plain text password, which is then converted on the ABA systems into cybertext," explains the ABA notification.

However, even with the passwords being hashed and salted, it is still possible for threat actors to dehash the passwords over time.

To make matters worse, the ABA says that "in many instances" the password may have been a default password assigned by the ABA when the account was registered if it was not later changed.

What should ABA members do?

The concern is that members may have used the same credentials on the new member system as those on the legacy system shut down in 2018.

If that is the case, it may be possible for the threat actors to use those credentials to gain access to the current ABA membership portal.

Furthermore, if the same credentials are used at other sites, the threat actors could attempt to gain access to other accounts used by the member.

Therefore, the ABA recommends that members change their passwords on the site and any other sites utilizing the same credentials.

All ABA members are advised to also watch for spear-phishing emails impersonating the ABA, as threat actors may use them to access further personal information.