National Math and Science Initiative nms.org National Math and Science Initiative data breach: what happened and what to do
The National Math and Science Initiative (NMSI) said an unauthorized party may have accessed its systems between September 23 and October 18, 2021. Notices went to 191,255 people. Names, addresses and Social Security numbers could have been accessed.
View all 13,177 breaches- Breach date
- 23 Sept 2021
- Made public
- 7 Feb 2022
- Affected
- 191,255
- Data exposed
- Names, Physical addresses, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The National Math and Science Initiative (NMSI) is a Texas nonprofit that supports math and science education. On or about October 13, 2021, its antivirus software flagged unusual activity on the network. NMSI's investigation found that an unauthorized party may have had access to certain systems between September 23 and October 18, 2021.
NMSI filed a notice with state regulators, and the breach appeared on the California Attorney General's list in February 2022. DataBreaches.Net reports the notice went to 191,255 people. The notice doesn't say whether they were students, teachers, employees or contractors.
Sources checked: maine.gov, databreaches.net, oag.ca.gov
Last verified against the official page:
What was exposed
The information that could have been accessed includes name, address and Social Security number. NMSI said it had no evidence the information was misused.
A Social Security number together with a name and address is enough to apply for credit or file a tax return in someone else's name. That risk doesn't expire quickly, so the credit steps below are worth doing even years later.
What to do
Read the notice letter if you received one, and use any free monitoring it offers. If you didn't get one but took part in an NMSI program, you can ask NMSI directly through its website.
What to do if you were in it
- 1
Use any monitoring offered in your notice
If your letter came with free credit monitoring, enroll using the instructions in it. The FTC recommends accepting what a company offers after a breach.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and blocks most new accounts opened in your name. You place it separately at Equifax, Experian and TransUnion, and the FTC explains how at consumer.ftc.gov. Lift it only when you apply for credit yourself.
- 3
Watch your statements and credit reports
Check bank, card and insurance statements for charges or claims you don't recognize. You can get free credit reports at AnnualCreditReport.com. If you find misuse, report it at IdentityTheft.gov.
- 4
Expect phishing that mentions the breach
Scammers use news of a breach to sound legitimate. Don't click links in unexpected emails or texts about it. Go to the company's own site, or call a number printed on your letter or card.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email or phone number appear in. Serus monitors breach databases and the dark web and alerts you when your data shows up, though it can't remove data from a breach.
Official filings
- California Attorney General , filed 7 Feb 2022
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the NMSI breach?
NMSI sent notices to the people whose information could have been accessed. If you took part in an NMSI program and got no letter, ask NMSI through its website.
What was exposed?
NMSI's notice says names, addresses and Social Security numbers could have been accessed. It said it had no evidence of misuse.
When did the breach happen?
An unauthorized party may have had access between September 23 and October 18, 2021. NMSI noticed unusual activity on or about October 13, 2021.
Should I freeze my credit?
Because Social Security numbers were involved, yes. A freeze is free and you place it separately at Equifax, Experian and TransUnion, according to the FTC.
Sources
- maine.gov/ag/attachments/985235c7-cb95-4be2-8792-a1252b4f8318/1f96651a-3919-4afe-9aec-5e15fb46df48/c245e41a-921a-4b2a-bb26-356f5eb93c02/NMSI%20-%20Notice%20of%20Data%20Event%20-%20ME.pdf
- databreaches.net/national-math-and-science-initiative-notifies-more-than-190000-of-data-security-incident
- oag.ca.gov/privacy/databreach/list
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
