American Bar Association americanbar.org American Bar Association data breach: what happened and what to do
The American Bar Association said an intruder reached an old, decommissioned system around March 6, 2023 and took old usernames and hashed, salted passwords. Outlets reported about 1.4 million legacy members. The ABA said it saw no sign of other personal or financial data being taken.
View all 13,177 breaches- Breach date
- 6 Mar 2023
- Data exposed
- Usernames, Passwords
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The American Bar Association (ABA) told members in April 2023 that someone had gained access to its network. The ABA says it detected unusual activity on March 17, 2023, and its investigation found the intruder had reached a decommissioned system, around March 6, that held older login details.
What was exposed
According to the ABA, the data was old usernames and passwords stored as hashed, salted values. Hashing scrambles a password so the original isn't stored in plain text, but weak or common passwords can still be guessed offline. The ABA said it found no sign of ransomware, no misuse of the data and no theft of other personal or financial information. Reports in security outlets put the number of affected legacy member accounts at about 1.4 million.
Why old logins still matter
The main risk is credential stuffing: attackers try the same email and password combination on other sites, such as email, banking and shopping accounts. That works because many people reuse passwords. A login that is years old can still match something you use today.
What the ABA asked members to do
The ABA urged affected members to change their ABA password and the password on any other site where they used the same one.
Where this leaves you
If you had an ABA account, assume your old password may be known and treat every account that shares it as exposed. The steps below are the ones the FTC and CISA recommend after a password leak.
Sources checked: securityaffairs.com, oag.ca.gov, cisa.gov
Last verified against the official page:
What to do if you were in it
- 1
Change your ABA password and any matching password
Change the password on every site where you used the same one. Start with your email account, since it can reset the others.
- 2
Use a unique password for each account
A password manager makes this practical. Pick long, random passwords so a leak at one site can't open another.
- 3
Turn on two-factor authentication
CISA recommends multifactor authentication on email, banking and any account that offers it. An authenticator app is safer than text messages where you have the choice.
- 4
Expect phishing that mentions the breach
Scammers use real names and addresses to sound credible. Don't click links in unexpected emails or texts, and contact the organization using the number on its official website.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email and phone number and tells you what to do next. Serus can't remove data from a breach, but it alerts you when your details turn up.
Frequently asked
Was I affected by the American Bar Association breach?
The ABA said legacy member logins were involved and notified affected members by email. If you had an old ABA account, treat it as affected.
What was exposed?
The ABA said old usernames and hashed, salted passwords. It said it found no sign that other personal or financial information was taken.
Should I change my password?
Yes. Change your ABA password and any other account that uses the same one.
Is there a settlement?
Security outlets reported that a class action followed the breach. No settlement is confirmed in the sources used for this page.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
