MalwareOtherRansomwareRansom DemandedRansom PaidData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)PIIMediumContained

YouthCare

bd_801cff6125522b5a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Sep 11, 2020

To disclose

8 weeks

Affected

3,410state residents only

Confidence

69%

Full breach record for YouthCare →

YouthCare, a non-profit, notified the Washington AG of a ransomware incident involving its third-party vendor Blackbaud. The attack occurred Feb 7 - May 20, 2020. YouthCare was notified on July 16, 2020. 3,410 Washington residents were affected. Data included names, addresses, DOBs, and contact info. No SSNs or financial data were accessed. Ransom was paid for data destruction confirmation.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 160 days

discovery → filing · 8 weeks / 57 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Sep 11, 2020

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,410 affectedView incident

Name: Schwabe, Williamson & Wyatt, P.C.
norm: schwabe williamson wyatt

Name: YouthCare
norm: youthcare
Industry: Otherllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 3,410state-resident count only
Data types: Identity (basic)PII
Data elements: NameDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: supply_chain

During the incident: Engaged independent forensics experts
Notified law enforcement
Expelled the criminal from its system
Paid a ransom in exchange for confirmation that data has been destroyed
Identified and eliminated the associated vulnerability
Hired its own cybersecurity team to continue monitoring
Hired ID Experts to provide professional support to affected individuals
Changes made: Accelerated efforts to further strengthen security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10304.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2020
Raw hash: cbcbece6371ac096bfac3d5cb6cc522ece0dad33674a1c75f4fbe228252f3ddd

Reporting entitySchwabe, Williamson & Wyatt, P.C.

Victim entityYouthCare

Incidentdiscovered Jul 16, 2020

Stated responseEngaged independent forensics experts

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com