MalwareHealthcareHealthcareRansomwareSupply Chain (3P Vendor)Data EncryptedRansom DemandedTargetedIdentity (basic)PIILowContained

University of Florida Health

bd_728a64ae310ce14e · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Aug 12, 2020

To disclose

27 days

Affected

11state residents only

Linked

3 filings

Confidence

65%

Full breach record for University of Florida Health →

University of Florida Health notified Montana DOJ of a third-party data breach involving Blackbaud, a service provider hosting UF Health data. Blackbaud suffered a ransomware attack in May 2020, with unauthorized access potentially dating to February 2020. UF Health was notified on July 16, 2020. The incident involved demographic PII (names, addresses, emails, DOBs) but explicitly excluded sensitive data like SSNs, medical records, or financial account numbers. Blackbaud reportedly paid ransom and assured data destruction. UF Health offered 12 months of credit monitoring via ID Experts.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 166 days

discovery → filing · 27 days

Feb 1, 2020

Begins

Jul 16, 2020

Discovered

Aug 12, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_0aae4f29004b430b2020-08-13 · +1dVerified
HHS OCRbd_2f82e5ca27b76f5d2020-08-14 · +2dVerified

Name: University of Florida Health
norm: university of florida health

Name: University of Florida Health
norm: university of florida health
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: Feb 1, 2020
Undetected for: 166 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 14, 2020
Affected individuals: 11state-resident count only
Data types: Identity (basic)PII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Began an investigation to understand whether any data was compromised and assess the impact
Hired ID Experts to provide MyIDCare identity theft protection services
Established required and necessary communications to customers and regulatory officials
Set up an informational website and call center
Changes made: Provided 12 months of credit and CyberScan monitoring
Provided a $1,000,000 insurance reimbursement policy
Provided fully managed identity theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGAug 12 · first · this page

New Hampshire State AG+1d

HHS OCR+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/University-of-Florida-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 12, 2020
Raw hash: fdb1ab920e1611ede07fce6b81598b8d8b8ba8d67dd091701ce7025f38297242

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityUniversity of Florida Health

Victim entityUniversity of Florida Health

Incidentdiscovered Jul 16, 2020

Stated responseBegan an investigation to understand whether any data was compromised and assess the impact

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov