NCCER Data Breach: Personal Information of 15k Individuals Exposed

National Center for Construction Education and Research (NCCER), a nonprofit organization based in Alachua, Florida, disclosed a data breach that affected 15,193 individuals in the United States, including 25 Maine residents.

NCCER detected unauthorized activity on its network in March 2025. Upon discovery, the organization took its systems offline until it could safely restore operations. NCCER also brought in cybersecurity specialists to investigate the incident and assist with remediation efforts.

The investigation determined that NCCER was the victim of a cybercrime carried out by a ransomware group known as Quilin.

Following the initial discovery, NCCER engaged a data review team on or around June 20, 2025, to determine what personal information was contained in the stolen files. Additional review was needed to identify and classify affected individuals, which concluded on or around April 12, 2026.

The personal information exposed in the breach included first and last names and Social Security numbers.

NCCER began notifying consumers by written notice on May 1, 2026.

NCCER's response to the breach

NCCER is offering 12 months of complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company. The services include single bureau credit monitoring, dark web monitoring and fully managed identity theft recovery services.

Affected individuals can activate their monitoring services by visiting the Cyberscout enrollment page and entering the unique code included in their notification letter. Enrollment must be completed within 90 days of the date on the letter.

For questions or assistance, a dedicated call center staffed by trained professionals is available at 1-833-877-7462, Monday through Friday from 8 a.m. to 8 p.m. Eastern Time, excluding major U.S. holidays.