The American Bar Association (ABA) is a voluntary bar association of lawyers and law students; it is not specific to any jurisdiction in the United States. The ABA has 166,000 members as of 2022.

The attackers may have gained access to the members’ credentials for a legacy member system that was decommissioned in 2018.

The security breach was detected on March 17, 2003 and according to the company the intrusion begun on or about March 6, 2023. The organization on Thursday began notifying members.

“On March 17, 2023, the ABA observed unusual activity on its network. The incident response plan was immediately activated response, and cybersecurity experts were retained to assist with the investigation,” reads the data breach notification email sent to impacted members, as reported by BleepingComputer.