MalwareEducationEducationRansomwareSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Trustees of Thayer Academy

bd_213c041b3db2b2db · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2020

Filed

Nov 9, 2020

To disclose

5 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for Trustees of Thayer Academy →4 incidents on file

Thayer Academy, a private school in Braintree, MA, notified the NH Attorney General of a data security incident involving its vendor, Blackbaud. A ransomware attack on Blackbaud's systems occurred between Feb 7 and May 20, 2020. Thayer determined on Oct 5, 2020, that personal information (name, address, phone, SSN) of 2 NH residents was compromised. Thayer notified individuals on Sep 16, 2020, offering 2 years of credit monitoring. Blackbaud implemented security hardening measures.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 235 days

discovery → filing · 6 weeks / 41 days

Feb 7, 2020

Begins

Sep 29, 2020

Discovered

Nov 9, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_18e232e35020375d2020-11-03 · +6dCandidate

Name: Trustees of Thayer Academy
norm: trustees of thayer academy
Domain: thayer.org

Name: Trustees of Thayer Academy
norm: trustees of thayer academy
Domain: thayer.org
Industry: Educationllm

Discovered: Sep 29, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 235 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection and Antitrust Bureau
Initial access: supply_chain

During the incident: Engaged legal counsel with expertise in cyber law
Conducted its own investigation
Provided notice to affected individuals
Notified appropriate government agencies
Actively monitor this situation
Follow-up with the vendor (Blackbaud)
Provided complimentary, two-year credit monitoring and identity theft membership in Experian's IdentityWorks 5M
Changes made: Blackbaud confirmed that its 'fix' withstands all known attack tactics
Blackbaud accelerated efforts to further harden its environment through enhancements to access management
Blackbaud implemented network segmentation
Blackbaud deployed additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGNov 3 · first

New Hampshire State AG+6d · this page

Pattern: first filing Nov 3 (ME), last Nov 9 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/thayer-academy-20201109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2020
Raw hash: 3afe5e63c205d73ff9cc4e663e0ee06a9c97c028b4b68916c4ee48efab14936d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTrustees of Thayer Academy

Victim entityTrustees of Thayer Academy

Incidentdiscovered Sep 29, 2020

Stated responseEngaged legal counsel with expertise in cyber law

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov