HackingOtherStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedHealth (basic)Identity (basic)PHIPIIMediumContained

Children's Cancer Association

bd_206f20a9ab67feb8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 7, 2020

Filed

Sep 14, 2020

To disclose

5 weeks

Affected

1,752state residents only

Linked

2 filings

Confidence

69%

Full breach record for Children's Cancer Association →2 incidents on file

Children's Cancer Association (CCA) notified the Washington AG of a third-party vendor breach involving Blackbaud. Unauthorized access to CCA donor/beneficiary data occurred between Feb 7 and May 20, 2020. CCA discovered the incident on Aug 7, 2020. Data types included names, DOBs, and limited medical info. 1,752 WA residents were notified. CCA engaged in investigation, FBI cooperation, and offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 182 days

discovery → filing · 5 weeks / 38 days

Feb 7, 2020

Begins

Aug 7, 2020

Discovered

Sep 14, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_c2921a363843f8332020-09-08 · +6dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Children's Cancer Association
norm: children s cancer
Industry: Otherllm

Discovered: Aug 7, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 182 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 4, 2020
Affected individuals: 1,752state-resident count only
Data types: Health (basic)Identity (basic)PHIPII
Data elements: NameDate of birthMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Washington Attorney GeneralBlackbaud reported incident to FBI
Initial access: supply_chain

During the incident: Launched an independent investigation
Worked with Blackbaud to ensure that its data was secure
Notified the potentially-affected individuals
Offered them 12 months of complimentary identity monitoring services through ID Experts
Reported this incident to the Federal Bureau of Investigation
Changes made: Offered 12 months of complimentary identity monitoring services through ID Experts
Blackbaud will continuously monitor the Internet for any exposure of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGSep 8 · first

Washington State AG+6d · this page

Pattern: first filing Sep 8 (OR), last Sep 14 (WA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10275.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2020
Raw hash: adec940aa15d82b1261aa1492b8ac4f5b135d9cdb35f30a4b4db39f646d5aab5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityChildren's Cancer Association

Incidentdiscovered Aug 7, 2020

Stated responseLaunched an independent investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com