Size of Breach at Collection Agency Doubles

It appears as though the data breach at NCB Management Services has expanded and now involves more than 1 million consumers, after originally indicating that 500,000 consumers were affected when details were first released back in March.

The company submitted another notification to the Maine Attorney General this week, indicating that 1,087,842 consumers were affected, up from 494,969 when it made its initial disclosure.

Details of the breach, provided in a letter that was sent out to affected consumers, seems to be the same as the details that were originally provided. Initially, the company said that:

NCB discovered on February 4 that an unauthorized party gained access to NCB’s systems on February 1, 2023. It was confirmed on March 8 that some of your client information previously connected with your Bank of America credit card account was potentially obtained by the unauthorized party.

In its most recent notification, the company said:

On February 4, 2023, NCB discovered that an unauthorized party gained access to NCB’s systems on February 1, 2023. After a thorough investigation, on April 19, 2023, NCB confirmed that some of your information was accessed by the unauthorized party. NCB has obtained assurances that the unauthorized third party no longer has access to any of NCB’s data.

Similar to the first letter, the second letter’s statement that the company has obtained assurances that the unauthorized third party no longer has access to any of the company’s data is a statement that is often associated with the payment of a ransom to those who perpetrated the attack.

The company is providing consumers with 24 months of identity monitoring, which includes a $1 million identity fraud loss reimbursement policy, as well as fraud consultation and identity theft restoration services, should they be needed.

The news that this breach was bigger than originally reported comes on the heels of another breach that was disclosed earlier this week that compromised the personal information of 345,000 consumers.