MalwareEducationEducationRansomwareSupply Chain (3P Vendor)Data ExfiltratedData EncryptedRansom DemandedRansom PaidCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

Florida State College at Jacksonville Foundation

bd_6bc4a6bc0d951f00 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Nov 30, 2020

To disclose

20 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Florida State College at Jacksonville Foundation →2 incidents on file

Florida State College at Jacksonville Foundation notified California residents of a data breach involving their vendor, Blackbaud. Blackbaud experienced a ransomware attack between February 7 and May 20, 2020, resulting in the exfiltration of backup files containing names and Social Security numbers. Blackbaud paid a ransom and confirmed the files were destroyed. The Foundation offered one year of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 20 weeks / 137 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Nov 30, 2020

Filed

vs. sector median

+11 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_67c1711743513d8e2020-11-30Candidate
Massachusetts State AGbd_a1f556119ec760672020-11-30Verified
New Hampshire State AGbd_139658b765d3625d2020-12-01 · +1dVerified

Name: Florida State College at Jacksonville Foundation
norm: florida state college at jacksonville

Name: Florida State College at Jacksonville Foundation
norm: florida state college at jacksonville
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud

During the incident: Conducted our own investigation of the Blackbaud services we use and the information provided by Blackbaud to determine what information was involved in the incident
Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Immediately deleted that data [non-encrypted Social Security numbers] and have instituted a policy ensuring that Social Security numbers will only be contained in properly encrypted fields
Changes made: Instituted a policy ensuring that Social Security numbers will only be contained in properly encrypted fields
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(137 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGNov 30 · first

Massachusetts State AGNov 30 · first

California State AGNov 30 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-196618
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 30, 2020
Raw hash: a1bde7b78e8424a1f578722c3c76e222e742989e7e02f4705deac9a1ff5ebd00

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityFlorida State College at Jacksonville Foundation

Victim entityFlorida State College at Jacksonville Foundation

Incidentdiscovered Jul 16, 2020

Stated responseConducted our own investigation of the Blackbaud services we use and the information provided by Blackbaud to determine what information was involved in the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov