MalwareOtherRansomwareCapture Stored DataRansom DemandedRansom PaidData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDownstream VictimsIdentity (basic)PIILowResolved

American Symphony Orchestra League

bd_5bbb3b52b74f4a4b · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 5, 2020

To disclose

—

Affected

Not disclosed

Confidence

79%

Full breach record for American Symphony Orchestra League →5 incidents on file

Blackbaud, a database vendor serving the League of American Orchestras (American Symphony Orchestra League), suffered a ransomware attack in which a cybercriminal removed a backup file containing donor/constituent personal information (names, addresses, phone numbers, email, demographic data, donation history). No credit card, bank account, or SSN data was involved. Blackbaud paid the ransom and obtained confirmation the data was destroyed. The letter was sent October 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

May 1, 2020

Begins

Oct 5, 2020

Filed

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: American Symphony Orchestra League
norm: american symphony orchestra league
Domain: americanorchestras.org

Name: American Symphony Orchestra League
norm: american symphony orchestra league
Domain: americanorchestras.org
Industry: Otherllm

Discovered: —
Breach occurred: May 1, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud

During the incident: Blackbaud's Cyber Security team—together with independent forensics experts and law enforcement—expelled the cybercriminal from their system
Blackbaud paid the cybercriminal's demand and received confirmation that the copy they removed had been destroyed
Blackbaud quickly identified the vulnerability associated with this incident, including the tactics used by the cybercriminal, and took swift action to fix it
The company confirmed through testing by multiple third parties, including the appropriate platform vendors, that its fix withstands all known attack tactics
Changes made: Enhancements to access management
Network segmentation
Deployment of additional endpoint and network-based platforms
Accelerating efforts to further harden their environment
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194747
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2020
Raw hash: ea4e0289c3c2b6b4e946e4db2172f58b2df07eaed8e4b3353daa2867e6155928

Reporting entityAmerican Symphony Orchestra League

Victim entityAmerican Symphony Orchestra League

IncidentRansomware

Stated responseBlackbaud's Cyber Security team—together with independent forensics experts and law enforcement—expelled the cybercriminal from their system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov