MalwareHealthcareEducationHealthcareRansomwareRansom DemandedData ExfiltratedSupply Chain (3P Vendor)PIIIdentity (basic)MediumResolved

THE MEDICAL UNIVERSITY OF SOUTH CAROLINA FOUNDATION

bd_7c03ba9f76095e09 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Sep 16, 2020

To disclose

9 weeks

Affected

85,897state residents only

Linked

2 filings

Confidence

65%

Full breach record for THE MEDICAL UNIVERSITY OF SOUTH CAROLINA FOUNDATION →3 incidents on file

Medical University of South Carolina (MUSC) notified donors of a ransomware incident involving third-party vendor Blackbaud, Inc. The attack occurred in May 2020, with data exfiltration dating back to February 2020. Blackbaud paid the ransom and confirmed destruction of stolen data. Affected data included names, contact info, demographics, and donation history. No SSN or financial account data was accessed. MUSC is reviewing security practices.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 166 days

discovery → filing · 9 weeks / 62 days

Feb 1, 2020

Begins

Jul 16, 2020

Discovered

Sep 16, 2020

Filed

vs. sector median

on median

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_3c482bb610bf77fd2020-09-11 · +5dVerified

Name: THE MEDICAL UNIVERSITY OF SOUTH CAROLINA FOUNDATION
norm: the medical university of south carolina

Name: THE MEDICAL UNIVERSITY OF SOUTH CAROLINA FOUNDATION
norm: the medical university of south carolina
Industry: HealthcarellmEducationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 1, 2020 – May 1, 2020
Undetected for: 166 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2020
Affected individuals: 85,897state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: MUSC is reviewing all relevant business practices and procedures regarding the security of your personal data
Blackbaud has reported that it has already implemented numerous security changes
Blackbaud has confirmed through testing by multiple third parties that Blackbaud’s fix withstands all known attack tactics
Blackbaud is further hardening its environment through enhancements to access management and network segmentation, plus deployment of additional endpoint and network-based platforms
Blackbaud has hired a third-party team of experts to monitor the dark web
Changes made: Implemented numerous security changes
Hardening its environment through enhancements to access management and network segmentation
Deployment of additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRSep 11 · first

South Carolina State AG+5d · this page

Pattern: first filing Sep 11 (SC), last Sep 16 (SC) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/MUSC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2020
Raw hash: 1f76d3b246cf181aab7c3211b7d7e21280749f212844f9707cfbeb70d9d0bfe1

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTHE MEDICAL UNIVERSITY OF SOUTH CAROLINA FOUNDATION

Victim entityTHE MEDICAL UNIVERSITY OF SOUTH CAROLINA FOUNDATION

Incidentdiscovered Jul 16, 2020

Stated responseMUSC is reviewing all relevant business practices and procedures regarding the security of your personal data

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov