Cyberattack on debt-buying giant exposes sensitive info on nearly 500,000 people

Nearly half a million people had their sensitive financial information leaked during a cyberattack on NCB Management Services – a company that purchases debt.

The Pennsylvania-based company sent out breach notification letters last week after discovering the attack on February 4.

In documents filed with Maine’s Attorney General, the company said 494,969 people had their names, addresses, phone numbers, email addresses, dates of birth, employment positions, pay amounts, driver's license numbers, Social Security numbers, account numbers, credit card numbers, routing numbers, account balances, and account statuses leaked.

“Recently, confidential client account information maintained by NCB was accessed by an unauthorized party. The information involved may have included details about a credit card account that you formerly had with Bank of America,” the company said.

“NCB discovered on February 4 that an unauthorized party gained access to NCB’s systems on February 1, 2023. It was confirmed on March 8 that some of your client information previously connected with your Bank of America credit card account was potentially obtained by the unauthorized party.”

The company claimed that it has “obtained assurances that the third party no longer has any of the information on its systems” – a statement often associated with the payment of a ransom.

The information stolen was related to credit card accounts but NCB noted that the impacted credit card accounts were all already closed.

According to the letters, federal law enforcement agencies are involved in the investigation and Bank of America is providing victims with two years of free identity theft protection service from Experian IdentityWorksSM.

“NCB is no longer servicing your closed credit card account with Bank of America,” the company added, urging those with questions to contact Bank of America.

Bank of America declined to comment. A consumer rights law firm is already investigating claims on behalf of individuals whose past due accounts with Bank of America were sold to NCB Management Services.

Debt buying companies like NCB have previously been targeted by hackers who value the troves of financial information they carry.

Last year, a ransomware attack on a medical debt collection company leaked sensitive information from 657 healthcare organizations.

Hackers stole accounts receivable balances, information regarding payments made to accounts, Social Security numbers, and health insurance data, medical treatment information and more.