MalwareOtherRansomwareRansom DemandedRansom PaidData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)PIILowContained

Helen Keller International

bd_33d7ec30d887c8ef · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 22, 2020

Filed

Jan 19, 2021

To disclose

28 days

Affected

534state residents only

Confidence

69%

Full breach record for Helen Keller International →3 incidents on file

Helen Keller International (HKI) notified the Washington AG of a ransomware attack on its third-party vendor, Blackbaud, Inc. The attack occurred between Feb 7 and May 20, 2020. HKI discovered on Dec 22, 2020 that donor names and dates of birth were exposed for 534 Washington residents. Blackbaud paid a ransom and confirmed data destruction. HKI notified affected individuals starting Aug 3, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 319 days

discovery → filing · 28 days

Feb 7, 2020

Begins

Dec 22, 2020

Discovered

Jan 19, 2021

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed534 affectedView incident

Name: Helen Keller International
norm: helen keller
Domain: hki.org

Name: Helen Keller International
norm: helen keller
Domain: hki.org
Industry: Otherllm

Discovered: Dec 22, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 319 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2020
Affected individuals: 534state-resident count only
Data types: Identity (basic)PII
Data elements: NameDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 300-399dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Began an internal investigation to identify what information may have been stored within the Blackbaud database
Worked to provide general notification regarding the incident to the HKI community which was distributed on August 3, 2020 via email
Providing notification as soon as possible via physical mailing to impacted individuals
Undertaken an in-depth investigation, with the assistance of independent forensic experts, into the impacted data
Changes made: Blackbaud is enhancing their safeguards to mitigate the risk of future attacks
Enhancements to access management, network segmentation, deployment of additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10392.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 19, 2021
Raw hash: 55ec9f9d8f20e892b2bbbf380b72a107b1c2c9399b9683c4119b92bbf5b3e4b5

Reporting entityHelen Keller International

Victim entityHelen Keller International

Incidentdiscovered Dec 22, 2020

Stated responseBegan an internal investigation to identify what information may have been stored within the Blackbaud database

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com