nbcc.org Listed by lockbit3 Ransomware Group

On July 31, 2023, the National Board for Certified Counselors (NBCC) appeared on the LockBit 3.0 ransomware leak site. The listing states that internal files were exfiltrated during a ransomware attack on the organization, which provides certification and research support to professional counselors across the United States. The exact number of people whose personal data was taken remains unknown, and the leak-site posting does not specify which categories of records were included beyond noting that 220 GB of material had been downloaded.

Details in the Primary Listing

The LockBit 3.0 leak page explicitly identifies NBCC as a victim and claims successful data exfiltration followed by encryption of systems. It lists the incident under the group’s standard naming format and provides a .onion link to samples of the stolen material. The disclosure indicates that personal data was among the files taken, although the full scope—such as whether counseling licensure records, client contact details, employee payroll files, or NDA-protected research—was not itemized. No ransom amount or payment deadline is shown in the public listing, which is consistent with LockBit’s practice of moving quickly to public shaming when negotiations stall.

July 31, 2023 marks the first public confirmation of the breach through the ransomware group’s own site, hosted via ransomware.live mirrors. The notification does not reveal how initial access was gained or how long the attackers remained inside NBCC’s network before exfiltrating the 220 GB archive.

Why This Matters for You and Your Family

When a professional certification board like NBCC suffers a breach, the people affected are often counselors, therapists, students pursuing licensure, and the clients whose information may appear in aggregated research or administrative files. If your counselor’s certification status, your own licensing application, or your family member’s mental-health provider details were stored in NBCC systems, that information can now sit in an attacker’s archive. Even without exact victim counts, the exposure of personal data in a 220 GB dump creates long-term risk because counseling records frequently contain names, addresses, phone numbers, email addresses, and sometimes Social Security numbers or dates of birth.

Ordinary families rely on licensed counselors for school placements, court-mandated therapy, or private practice. A breach at the certifying body can therefore ripple outward, exposing both the professionals and the households they serve. The disclosure makes clear that internal files left NBCC’s control, and once data reaches a ransomware leak site it is routinely resold or published in full.

The Doxxing and Identity-Chain Risk

Stolen counseling-board records rarely stay isolated. An email address tied to a licensed counselor can be cross-referenced with state licensing boards, professional directories, and private-practice websites. That linkage quickly produces home addresses, spouse names, and children’s school information. Attackers then use these connections to launch credential-stuffing attacks against personal email, banking, or social-media accounts. In many cases the chain continues into gaming platforms where teenagers use the same or similar passwords, turning a professional breach into a household compromise that can lead to full identity theft or extortion attempts against family members.

Public reporting on similar incidents shows that once personal data reaches criminal forums, it is indexed, bundled, and resold for years. The risk is not theoretical: a single exposed counseling-related record can anchor an attacker’s profile of your entire household.

LockBit 3.0’s Known Track Record

LockBit first appeared in 2019 and rebranded through successive versions, with LockBit 3.0 emerging in 2022. Public reporting attributes to the group a pattern of targeting healthcare, education, government, and professional associations. Notable prior victims include numerous hospitals, school districts, and certification bodies where sensitive personal and licensing data reside. Their typical playbook begins with phishing or exploited remote-desktop credentials for initial access, followed by lateral movement, data exfiltration, and deployment of ransomware. When ransom is not paid, LockBit publishes samples and offers the full archive for download or sale on their leak site, applying steady pressure through countdown timers and threats to notify regulators or clients. The group’s leak site has remained one of the most active ransomware boards despite multiple law-enforcement actions against its affiliates.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at NBCC or related professional sites and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same email addresses or passwords exposed in professional breaches like this one.
• Let DoxxScan remediation specialists handle takedown requests for any personal information already appearing on data-broker or extortion sites.

The NBCC incident is a reminder that even organizations dedicated to helping people can become gateways for identity compromise that reaches your front door. A single ransomware listing can seed years of targeted fraud and doxxing unless you map and close the exposure chains early. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give families a practical way to stay ahead of these cascading threats.