DisclosureLens
HackingOtherHacking OtherSupply Chain (3P Vendor)Customer Data InvolvedPIIGovernment IDMediumResolved

The Bowery Mission

bd_529f776d75d7985a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 30, 2020

Filed

Nov 15, 2020

To disclose

16 days

Affected · nationwide

1612 in this filing

Linked

4 filings

Confidence

50%
Full breach record for The Bowery Mission

The Bowery Mission, a non-profit organization, was impacted by a security incident involving its cloud software provider, Blackbaud. An unauthorized third party gained access to Blackbaud's systems between February 7, 2020, and July 9, 2020. It was initially believed that client data was encrypted and inaccessible, but Blackbaud later confirmed that the information was unencrypted and accessible to the cybercriminal. The breach, discovered on October 30, 2020, affected 161 individuals, including 2 Maine residents, and compromised their names and Social Security numbers. The Bowery Mission began notifying affected individuals on November 17, 2020, and offered 12 months of complimentary credit and identity monitoring services.

Maine clockDiscovered Oct 30, 2020Filed with AG Nov 15, 202016d ME AG ≤30d16 days discovery → filing
unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 266 days
discovery → filing · 16 days

Feb 7, 2020

Begins

Oct 30, 2020

Discovered

Nov 15, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Massachusetts State AGNov 15 · first
Maine State AGNov 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.