MalwareEducationEducationRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowContained

Florida Gulf Coast University Foundation, Inc.

bd_86919dde9b3a5d89 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Jan 11, 2021

To disclose

26 weeks

Affected

11state residents only

Linked

4 filings

Confidence

66%

Full breach record for Florida Gulf Coast University Foundation, Inc. →2 incidents on file

Florida Gulf Coast University Foundation, Inc. reported a ransomware incident involving third-party vendor Blackbaud, Inc. affecting 11 New Hampshire residents. Blackbaud experienced a ransomware attack in May 2020, resulting in data encryption and exfiltration before being locked out on May 20, 2020. FGCU Foundation was notified on July 16, 2020, confirmed affected individuals by December 5, 2020, and sent notices on January 4, 2021. Affected data included names and financial account information. Remediation included credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 26 weeks / 179 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Jan 11, 2021

Filed

vs. sector median

+17 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_3877cf191e98ca412021-01-04 · +7dVerified
Montana State AGbd_c123755c7024cff32021-01-04 · +7dCandidate
Maine State AGbd_c8c97bc3e0887fba2021-01-04 · +7dVerified by operator

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Florida Gulf Coast University Foundation, Inc.
norm: florida gulf coast university
Domain: fgcu.edu
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020 – May 20, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 4, 2021
Affected individuals: 11state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Engaged forensic investigators (via Blackbaud)
Notified law enforcement (via Blackbaud)
Provided access to credit monitoring services for one (1) year through TransUnion
Provided guidance on how to better protect against identity theft and fraud
Advised individuals to report suspected incidents to credit card company and/or bank
Provided information on how to place a fraud alert and security freeze on credit file
Provided contact details for national consumer reporting agencies
Encouraged contact with Federal Trade Commission, state Attorney General, and law enforcement
Changes made: Continuing to work with Blackbaud to address relevant questions and next steps
Notifying state regulators as required
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(179 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJan 4 · first

Montana State AGJan 4 · first

Maine State AGJan 4 · first

New Hampshire State AG+7d · this page

Pattern: first filing Jan 4 (IN), last Jan 11 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/florida-gulf-coast-university-foundation-20210111.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 11, 2021
Raw hash: e7af6ae632963c96b0fe1d8fd3f331e3d78e11cabe628175716f408ba0d32654

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityFlorida Gulf Coast University Foundation, Inc.

Incidentdiscovered Jul 16, 2020

Stated responseEngaged forensic investigators (via Blackbaud)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov