MalwareOtherRansomwareSupply Chain (3P Vendor)Data ExfiltratedData EncryptedPIIIdentity (basic)LowContained

Marines' Memorial Association & Foundation

bd_0a5a7a3341869b7b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Apr 6, 2021

To disclose

38 weeks

Affected

20state residents only

Linked

7 filings

Confidence

65%

Full breach record for Marines' Memorial Association & Foundation →

Marines’ Memorial Association & Foundation notified members of a third-party vendor (Blackbaud) ransomware incident. The vendor was compromised in May 2020, resulting in data encryption and exfiltration. MMA discovered the incident on July 16, 2020, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 38 weeks / 264 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Apr 6, 2021

Filed

vs. sector median

+30 wks slower

This filing is one of 7 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_1df75684dd9eff162021-04-06Verified by operator
Indiana State AGbd_54cbdf830b24e1302021-04-06Verified
Maine State AGbd_67ac2d4038cabcec2021-04-06Verified by operator
California State AGbd_d2fe0527402c57472021-04-06Verified

Show 2 more filings ↓up to 6d gap

Massachusetts State AGbd_e797f03f5607a3212021-04-06Verified
New Hampshire State AGbd_24a6df15990249932021-04-12 · +6dVerified

Name: Marines' Memorial Association & Foundation
norm: marines memorial
Domain: marinesmemorial.org

Name: Marines' Memorial Association & Foundation
norm: marines memorial
Domain: marinesmemorial.org
Industry: Otherllm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020 – May 20, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 20state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notifying state regulators, as required
Third party: via Blackbaud, Inc.

During the incident: Commenced an investigation to better understand the nature and scope of the incident
Working with forensic investigators to gather further information from Blackbaud
Notifying state regulators, as required
Offering 1 year of complimentary credit monitoring and identity protection services through Experian
Changes made: Reviewing existing policies and procedures regarding programs and services provided by third-party vendors
Working with Blackbaud to confirm they have implemented additional measures and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(264 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGApr 6 · first

Indiana State AGApr 6 · first

Maine State AGApr 6 · first

California State AGApr 6 · first

Massachusetts State AGApr 6 · first

Montana State AGApr 6 · first · this page

New Hampshire State AG+6d

Pattern: first filing Apr 6 (WA), last Apr 12 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Marine-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2021
Raw hash: 63eb5d0a5b30411fb6266148963a7e0dc947999a1b37a44d1bca8507f4e0eb9f

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMarines' Memorial Association & Foundation

Victim entityMarines' Memorial Association & Foundation

Incidentdiscovered Jul 16, 2020

Stated responseCommenced an investigation to better understand the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov