MalwareOtherRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

THE NEW-YORK HISTORICAL SOCIETY

bd_594d2a03cda20ede · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Nov 30, 2020

To disclose

20 weeks

Affected

2state residents only

Linked

4 filings

Confidence

65%

Full breach record for THE NEW-YORK HISTORICAL SOCIETY →3 incidents on file

New-York Historical Society filed a supplemental notice with the New Hampshire Attorney General regarding a ransomware incident involving third-party vendor Blackbaud. The incident, occurring in May 2020, resulted in the potential exfiltration of names, Social Security numbers, and financial account information. Approximately two New Hampshire residents were affected. The Society provided credit monitoring services to impacted individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 57 days

discovery → filing · 20 weeks / 137 days

May 20, 2020

Begins

Jul 16, 2020

Discovered

Nov 30, 2020

Filed

vs. sector median

+11 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_e76af978be176d712020-11-25 · +5dCandidate
Maine State AGbd_019db491302c56392020-12-22 · +22dVerified
New Hampshire State AGbd_ed0eabf98791e2f22020-10-13 · +48dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: THE NEW-YORK HISTORICAL SOCIETY
norm: the new york historical society
Industry: Otherllm

Discovered: Jul 16, 2020
Breach occurred: May 20, 2020
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 25, 2020
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Worked with Blackbaud to learn more about the incident and determine what N-YHS data may be involved
Worked diligently to identify and notify those individual whose information may have been affected
Providing potentially impacted individuals with access to credit monitoring and identity services provided by Blackbaud through Cyberscout for two (2) years
Providing potentially impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Reviewing existing policies and procedures regarding third-party vendors
Working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(137 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

New Hampshire State AGOct 13 · first

Maine State AG+43d

New Hampshire State AG+48d · this page

Maine State AG+70d

Pattern: first filing Oct 13 (NH), last Dec 22 (ME) — a 70-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/new-york-historical-society-20201130.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2020
Raw hash: 921751ca1fa699a3d5e0f52172abb1d24834eca17c72335d7c6884fbc49e77b9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityTHE NEW-YORK HISTORICAL SOCIETY

Incidentdiscovered Jul 16, 2020

Stated responseWorked with Blackbaud to learn more about the incident and determine what N-YHS data may be involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov