MalwareHealthcareProfessional ServicesHealthcareRansomwareData MishandlingSupply Chain (3P Vendor)Data ExfiltratedData EncryptedRansom DemandedRansom PaidCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Helen Keller Services for the Blind

bd_6c4923dc9dd52de5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Jan 20, 2021

To disclose

27 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Helen Keller Services for the Blind →

Helen Keller Services for the Blind notified the NH Attorney General of a third-party ransomware incident involving vendor Blackbaud. Unauthorized access occurred Feb 7–May 20, 2020. One NH resident's name and SSN were exposed in unencrypted backup files. Blackbaud paid ransom and confirmed file destruction. Notification sent Jan 15, 2021, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 27 weeks / 188 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Jan 20, 2021

Filed

vs. sector median

+16 wks slower

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Helen Keller Services for the Blind
norm: helen keller services for the blind

Name: Helen Keller Services for the Blind
norm: helen keller services for the blind
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 15, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Gordon MacDonald
Initial access: supply_chain

During the incident: Providing written notice to the New Hampshire resident by mailing letters via United States Postal Service First-Class mail
Offering the New Hampshire resident a complimentary, one-year membership to credit monitoring and identity theft prevention services through Experian
Established a dedicated phone number where all individuals may obtain more information regarding the incident
Re-evaluating its relationship with Blackbaud
Reviewing the security requirements it has for its data solution service vendors
Changes made: Blackbaud identified and fixed the vulnerability associated with this incident
Blackbaud implemented several changes that will better protect data
Blackbaud undertaking additional efforts to improve the security of its environment through enhancements to access management
Blackbaud undertaking additional efforts to improve the security of its environment through enhancements to network segmentation
Blackbaud undertaking additional efforts to improve the security of its environment through deployment of additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(188 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/helen-keller-services-blind-20210120.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 20, 2021
Raw hash: 1ce31d72e171c7e375a6b55c1c52377fe2e3c12efd124fda08fe96c84364fbb0

Reporting entityHelen Keller Services for the Blind

Victim entityHelen Keller Services for the Blind

Incidentdiscovered Jul 16, 2020

Stated responseProviding written notice to the New Hampshire resident by mailing letters via United States Postal Service First-Class mail

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov