MalwareEducationEducationRansomwareRansom DemandedRansom PaidData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)PIILowContained

Saybrook University

bd_1035d46ca559c78a · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 14, 2020

Filed

Sep 8, 2020

To disclose

25 days

Affected

935state residents only

Confidence

69%

Full breach record for Saybrook University →

Saybrook University notified Washington AG of a ransomware attack on third-party provider Blackbaud. Unauthorized access occurred Feb-May 2020. Attackers exfiltrated a subset of data including contact, demographic, and education details. Blackbaud paid ransom and engaged forensics. 935 Washington residents affected. Notification sent July 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 189 days

discovery → filing · 25 days

Feb 7, 2020

Begins

Aug 14, 2020

Discovered

Sep 8, 2020

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed935 affectedView incident

Name: Saybrook University
norm: saybrook university

Name: Saybrook University
norm: saybrook university
Industry: Educationllm

Discovered: Aug 14, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 189 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 16, 2020
Affected individuals: 935state-resident count only
Data types: Identity (basic)PII
Data elements: NameDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Commenced an investigation to determine what personal information was potentially impacted
Locked the cybercriminal out of their system
Engaged independent forensics experts
Notified law enforcement
Changes made: Blackbaud identified and fixed the vulnerability associated with the incident
Blackbaud accelerated efforts to further secure their environment
Blackbaud hired a third-party firm to monitor for any misuse or public posting of the removed data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10298.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2020
Raw hash: 97cf229762d1fee79d2307013330f3c56e5139dd0cbd0b529dbb5f7890f9986a

Reporting entitySaybrook University

Victim entitySaybrook University

Incidentdiscovered Aug 14, 2020

Stated responseCommenced an investigation to determine what personal information was potentially impacted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com