MalwareFinancial ServicesEducationFinanceRansomwareData MishandlingSupply Chain (3P Vendor)Data ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Vermont Student Assistance Corporation

bd_79f77c4712b37181 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Oct 4, 2020

To disclose

11 weeks

Affected

48state residents only

Linked

7 filings

Confidence

66%

Full breach record for Vermont Student Assistance Corporation →2 incidents on file

Vermont Student Assistance Corporation (VSAC) notified Montana authorities of a third-party vendor breach involving Blackbaud. A ransomware incident at Blackbaud in May 2020 led to the encryption of systems and exfiltration of a database backup containing VSAC customer names and SSNs. VSAC notified 48 Montana residents on September 4, 2020, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 11 weeks / 80 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Oct 4, 2020

Filed

vs. sector median

+1 wks slower

This filing is one of 7 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_08c27a98ee1b1bf42020-09-25 · +9dVerified
Maine State AGbd_2c1946e3a02b43172020-09-25 · +9dCandidate
New Hampshire State AGbd_234aa8a01aad80222020-09-08 · +26dVerified
Indiana State AGbd_71e4dd920ac5fc822020-09-04 · +30dVerified

Show 2 more filings ↓up to 30d gap

Massachusetts State AGbd_9c0dafe3199fe92a2020-09-04 · +30dVerified
California State AGbd_bca2d0e8282fb4bc2020-09-04 · +30dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Vermont Student Assistance Corporation
norm: vermont student assistance
Industry: Financial ServicesllmEducationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 4, 2020
Affected individuals: 48state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Montana Department of Justice Office of Consumer ProtectionNotifying state and federal regulators
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Commenced an investigation to better understand the nature and scope of the incident
Working with Blackbaud to evaluate additional measures and safeguards
Offered complimentary access to 24 months of credit monitoring services through Experian
Established a dedicated call center for potentially affected individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Notifying state and federal regulators
Changes made: Reviewing existing policies and procedures regarding third-party vendors
Working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(80 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Indiana State AGSep 4 · first

Massachusetts State AGSep 4 · first

California State AGSep 4 · first

New Hampshire State AG+4d

California State AG+21d

Maine State AG+21d

Montana State AG+30d · this page

Pattern: first filing Sep 4 (IN), last Oct 4 (MT) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/VSAC-Notification.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 4, 2020
Raw hash: 54e677efc198c499fc892b481d10defa775265781d3d11a518586d18875798f4

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityVermont Student Assistance Corporation

Incidentdiscovered Jul 16, 2020

Stated responseCommenced an investigation to better understand the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov