HackingEducationEducationSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)MinorMediumContained

Archbishop Mitty High School

bd_5bd90ff714a68a5e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 1, 2020

Filed

Jun 16, 2021

To disclose

41 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Archbishop Mitty High School →

Archbishop Mitty High School notified the California Attorney General of a data breach involving its third-party vendor, Blackbaud, Inc. A cyber-attack on Blackbaud exposed backup files containing personal information of former students, including Social Security numbers, dates of birth, mailing addresses, and telephone numbers. The school discovered the incident in September 2020 when Blackbaud advised them that certain legacy data was not encrypted as previously assured. The school is providing 24 months of credit monitoring and fraud assistance to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 107 days

discovery → filing · 41 weeks / 288 days

May 17, 2020

Begins

Sep 1, 2020

Discovered

Jun 16, 2021

Filed

vs. sector median

+31 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_d54320e159f150e92021-06-16Verified by operator
New Hampshire State AGbd_b7f0b609aa69e1612021-06-22 · +6dVerified

Name: Archbishop Mitty High School
norm: archbishop mitty high school

Name: Archbishop Mitty High School
norm: archbishop mitty high school
Industry: Educationllm

Discovered: Sep 1, 2020
Breach occurred: May 17, 2020
Undetected for: 107 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Minor
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Blackbaud, Inc
Initial access: supply_chain

During the incident: Opened a thorough internal review of the records maintained by our institution via Blackbaud
Worked extensively with Blackbaud to determine the scope of this incident and its impact on Archbishop Mitty High School’s student and alumni records
Providing you with access to Single Bureau Credit Monitoring services at no charge for twenty-four months
Providing you with proactive fraud assistance to help with any questions you might have
Providing access to remediation support from a CyberScout Fraud Investigator
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(288 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJun 16 · first

California State AGJun 16 · first · this page

New Hampshire State AG+6d

Pattern: first filing Jun 16 (MT), last Jun 22 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-541910
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 16, 2021
Raw hash: e8fb814cc1eee2c25f98698bf5bfdc6544fbc2701d2d2a61acfac05d6cc694da

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityArchbishop Mitty High School

Victim entityArchbishop Mitty High School

Incidentdiscovered Sep 1, 2020

Stated responseOpened a thorough internal review of the records maintained by our institution via Blackbaud

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov