MalwareRansomwareSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Vermont State Colleges (which consists of Castleton University, Northern Vermont University, and Vermont Technical College)
bd_2be62917a7ff2251 · schema v1 · pii pii-v1
Full breach record for Vermont State Colleges (which consists of Castleton University, Northern Vermont University, and Vermont Technical College) →Vermont State Colleges reported a ransomware incident involving its vendor, Blackbaud Inc., discovered in July 2020. The breach affected 289 individuals, including one Maine resident. Compromised data included names and financial account numbers. Written notification was sent to affected individuals in February 2021.
Maine clockDiscovered Jul 16, 2020 → Filed with AG Feb 24, 2021223d ✗ ME AG >90d32 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed289 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1ed77580-8b19-4da6-bf5e-f24581d66304.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 24, 2021
- Raw hash
- 786535b459e01f69cb270d31efb74c0a92578dd0404de0d17cb980ed3f6d913e
Reporting entity
- Name
- Vermont State Colleges (which consists of Castleton University, Northern Vermont University, and Vermont Technical College)norm: vermont state colleges which consists of castleton university northern vermont university and vermont technical college
- Domain
- vsc.edu
- Industry
- Education
Victim entity
- Name
- Vermont State Colleges (which consists of Castleton University, Northern Vermont University, and Vermont Technical College)norm: vermont state colleges which consists of castleton university northern vermont university and vermont technical college
- Domain
- vsc.edu
- Industry
- Education
Incident
- Discovered
- Jul 16, 2020
- Materiality determined
- —
- Notification sent
- Feb 23, 2021
- Affected individuals
- 289
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for Impact
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with the Maine Attorney General
- Third party
- via Blackbaud Inc.
- Initial access
- supply_chain
Compliance
- Time to disclose
- 32 weeks(223 days from discovery to filing)
- Compliance flags
- ME AG >90d · 223dME resident >180d · 222d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 16, 2020→ Filed with AG: Feb 24, 2021223d 90 days ME AG >90d Maine Discovered: Jul 16, 2020→ Notified: Feb 23, 2021222d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.