MalwareHealthcareHealthcareRansomwareData MishandlingSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedCustomer Data InvolvedBusiness Associate (HIPAA)Identity (basic)Health (basic)LowContained

Saint Luke's Foundation

bd_40681e258ce07a60 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Aug 20, 2020

To disclose

5 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Saint Luke's Foundation →

Saint Luke's Foundation notified individuals that a third-party vendor, Blackbaud, experienced a ransomware attack between Feb 7 and May 20, 2020. The cybercriminal exfiltrated a backup file containing patient demographic data (name, address, phone, email, DOB) and limited medical information (date of service, department of care). No SSNs or financial data were compromised. Blackbaud contained the incident and is monitoring for misuse.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 5 weeks / 35 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Aug 20, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_5bcfb721c1a28b412020-08-20Verified
Montana State AGbd_a719806d5eb32ec02020-08-20Verified

Name: Saint Luke's Foundation
norm: saint luke s

Name: Saint Luke's Foundation
norm: saint luke s
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Notified affected individuals
Engaged third-party experts to monitor the dark web for misuse of data
Implemented changes to protect systems from subsequent incidents
Identified and fixed vulnerability associated with the incident
Accelerated efforts to harden environment through enhancements to access management, network segmentation, and deployment of additional endpoint and network-based platforms
Changes made: Enhanced access management
Implemented network segmentation
Deployed additional endpoint and network-based security platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRAug 20 · first

Montana State AGAug 20 · first

California State AGAug 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193317
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2020
Raw hash: 449a08b73131eb6944e53b02e643b9c92260e0c868f33aee020cef5098d55cea

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySaint Luke's Foundation

Victim entitySaint Luke's Foundation

Incidentdiscovered Jul 16, 2020

Stated responseNotified affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov