MalwareOtherRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedBiometricFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Marines' Memorial Association & Foundation

bd_1df75684dd9eff16 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 16, 2020

Filed

Apr 6, 2021

To disclose

38 weeks

Affected

2,625state residents only

Linked

7 filings

Confidence

69%

Full breach record for Marines' Memorial Association & Foundation →

Marines' Memorial Association & Foundation notified Washington AG of a third-party vendor (Blackbaud) ransomware incident. Data accessed included names, SSNs, DOBs, financial accounts, and health info. 2,625 WA residents affected. Incident occurred Feb-May 2020; discovered July 2020. Notices sent April 2021.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d38 weeks discovery → filing

Incident timeline

undetected · 160 days

discovery → filing · 38 weeks / 264 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Apr 6, 2021

Filed

vs. sector median

+30 wks slower

This filing is one of 7 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_0a5a7a3341869b7b2021-04-06Candidate
Indiana State AGbd_54cbdf830b24e1302021-04-06Verified
Maine State AGbd_67ac2d4038cabcec2021-04-06Verified by operator
California State AGbd_d2fe0527402c57472021-04-06Verified

Show 2 more filings ↓up to 6d gap

Massachusetts State AGbd_e797f03f5607a3212021-04-06Verified
New Hampshire State AGbd_24a6df15990249932021-04-12 · +6dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Marines' Memorial Association & Foundation
norm: marines memorial
Industry: Otherllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2021
Affected individuals: 2,625state-resident count only
Data types: BiometricFinancial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberFinancial account numberDate of birthMilitary ID numberHealth insurance IDMedical informationBiometric data
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General (Washington)Notifying regulators as required
Initial access: supply_chain

During the incident: Commenced own investigation to determine scope of incident
Worked with forensic investigators to gather further information from Blackbaud
Obtained list of potentially impacted individuals
Provided written notice to all affected individuals
Providing individuals with access to credit monitoring services through Experian for one year at no cost
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Notifying regulators as required
Changes made: Diligently reviewing existing policies and procedures regarding programs and services provided by third-party vendors
Working with Blackbaud to confirm they have implemented additional measures and safeguards to protect against this type of incident in the future
Continuing to evaluate, monitor, and update all information systems and cyber protection tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(264 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGApr 6 · first

Indiana State AGApr 6 · first

Maine State AGApr 6 · first

California State AGApr 6 · first

Massachusetts State AGApr 6 · first

Washington State AGApr 6 · first · this page

New Hampshire State AG+6d

Pattern: first filing Apr 6 (MT), last Apr 12 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10438.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2021
Raw hash: 59488928d64d20f61c9df2fa5c3c31d6699ff7e3d2c0e0926da35492698f48b8

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityMarines' Memorial Association & Foundation

Incidentdiscovered Jul 16, 2020

Stated responseCommenced own investigation to determine scope of incident

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com