MalwareEducationTechnologyEducationRansomwareRansom DemandedRansom PaidData EncryptedData ExfiltratedCustomer Data InvolvedMulti-Stage ChainGovernment IDCredentialsFinancial accountMediumContained

Blackbaud, Inc.

bd_864567c1a7c8f44b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Sep 29, 2020

To disclose

11 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Princeton Day School notified Montana residents of a ransomware attack on third-party vendor Blackbaud, Inc. in May 2020. The attack exposed unencrypted vendor tax IDs, SSNs, usernames, passwords, and bank account info. Blackbaud paid a ransom, confirmed data destruction, and offered credit monitoring. Princeton Day School is the reporting entity; Blackbaud is the victim entity.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 11 weeks / 75 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Sep 29, 2020

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_9d2322f9bb506fe32020-11-17 · +49dVerified
Maine State AGbd_fa646220b80107b92020-11-17 · +49dVerified

Name: PRINCETON DAY SCHOOL, INC.
norm: princeton day school

Name: Blackbaud, Inc.
norm: blackbaud
Industry: EducationllmTechnologyllm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Government IDCredentialsFinancial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via Blackbaud, Inc.

During the incident: Paid a ransom to the attacker
Enhancing safeguards to mitigate the risk of future attacks
Offering complimentary credit monitoring services
Hired a third-party team of experts to monitor the dark web
Changes made: Enhancements to access management
Network segmentation
Deployment of additional endpoint and network-based platforms
Deleting the legacy database that was compromised
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGSep 29 · first · this page

Massachusetts State AG+49d

Maine State AG+49d

Pattern: first filing Sep 29 (MT), last Nov 17 (ME) — a 49-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/princeSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 29, 2020
Raw hash: 752a6a6fab5ca35d1e4cfe487eddff999ea7abc50f90bcbf5f38487785756b74

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPRINCETON DAY SCHOOL, INC.

Victim entityBlackbaud, Inc.

Incidentdiscovered Jul 16, 2020

Stated responsePaid a ransom to the attacker

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov