MalwareEducationProfessional ServicesEducationRansomwareData MishandlingSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedRansom PaidDelayed DiscoveryCustomer Data InvolvedIdentity (basic)BehaviorEducationLowContained

NORTHWEST FOUNDATION, INC.

bd_0a557aa8ecb3a0a0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Aug 7, 2020

To disclose

22 days

Affected

Not disclosed

Confidence

65%

Full breach record for NORTHWEST FOUNDATION, INC. →2 incidents on file

Northwest Foundation, Inc. notified constituents of a data breach involving its service provider, Blackbaud, Inc. A ransomware attack on a Blackbaud service provider in May 2020 resulted in the exfiltration of a subset of Northwest Foundation's data. Affected data included names, titles, dates of birth, addresses, contact details, philanthropic interests, giving history, and educational attainment. Social security numbers, bank account numbers, and credit card information were not accessed. Blackbaud paid the ransom and asserted the data was destroyed. Northwest Foundation launched an investigation and is notifying affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 22 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Aug 7, 2020

Filed

vs. sector median

5 wks faster

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: NORTHWEST FOUNDATION, INC.
norm: northwest foundation

Name: NORTHWEST FOUNDATION, INC.
norm: northwest foundation
Industry: EducationllmProfessional Servicesllm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020 – May 31, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)BehaviorEducation
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Notifying affected alumni and friends to make them aware of this breach of Blackbaud’s systems
Working with Blackbaud to understand why there was a delay between it finding the breach and notifying us, as well as what actions Blackbaud is taking to increase its security
Conferring with other Blackbaud clients to share information about this breach, resulting corrective actions and identify any additional recommended best practices
Posting additional notifications regarding this incident to https://www.nwmissouri.edu/alumni/blackbaud.htm
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192817
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2020
Raw hash: 207b47d5b44ec8f3cb0aea1d5aeb39e144568e5c923a83720da3a13fd63af7d2

Reporting entityNORTHWEST FOUNDATION, INC.

Victim entityNORTHWEST FOUNDATION, INC.

Incidentdiscovered Jul 16, 2020

Stated responseNotifying affected alumni and friends to make them aware of this breach of Blackbaud’s systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov