MalwareOtherRansomwareRansom DemandedRansom PaidData ExfiltratedSupply Chain (3P Vendor)PIIIdentity (basic)FinancialLowContained

League of American Orchestras

bd_6ce5fff4f38f6653 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 5, 2020

To disclose

—

Affected

357state residents only

Linked

2 filings

Confidence

67%

League of American Orchestras notified Montana residents of a ransomware attack on third-party vendor Blackbaud. Attackers exfiltrated a backup file containing PII (names, addresses, donation history) before being expelled. Blackbaud paid the ransom and confirmed data destruction. No SSN or credit card data was accessed. Incident status is contained.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Oct 5, 2020

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 2 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Washington State AGbd_a287ccaa3bf10c662020-10-09 · +4dVerified

Name: League of American Orchestras
norm: league of american orchestras
Domain: americanorchestras.org

Name: League of American Orchestras
norm: league of american orchestras
Domain: americanorchestras.org
Industry: Otherllm

Discovered: —
Materiality determined: —
Notification sent: Oct 1, 2020
Affected individuals: 357state-resident count only
Data types: PIIIdentity (basic)Financial
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Expelled the cybercriminal from their system
Engaged independent forensics experts
Engaged law enforcement
Paid the cybercriminal’s demand
Confirmed that the copy of data was destroyed
Identified the vulnerability associated with this incident
Fixed the vulnerability
Conducted testing by multiple third parties
Accelerating efforts to further harden their environment
Enhancing access management
Implementing network segmentation
Deploying additional endpoint and network-based platforms
Changes made: Fixed the vulnerability associated with the incident
Enhancements to access management
Network segmentation
Deployment of additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGOct 5 · first · this page

Washington State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/leagueSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 5, 2020
Raw hash: ca3f33b345043f300e0a828927e452ab8d097c9460f5fd23b8eb4f0407229a6c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLeague of American Orchestras

Victim entityLeague of American Orchestras

IncidentRansomware

Stated responseExpelled the cybercriminal from their system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov