MalwareEducationEducationRansomwareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

San Francisco Conservatory of Music

bd_9d9371c1a2c14bce · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 29, 2020

Filed

Jan 29, 2021

To disclose

17 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for San Francisco Conservatory of Music →

San Francisco Conservatory of Music notified individuals that their personal information may have been accessed by an unknown actor via a ransomware incident at third-party vendor Blackbaud, Inc. Data was exfiltrated before Blackbaud locked the actor out on May 20, 2020. SFCM learned of the impact on September 29, 2020. Affected data includes names and potentially financial account information. SFCM is offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 29, 2020 → Notified Jan 8, 2021101d ✗ CA 60-day late17 weeks discovery → filing

Incident timeline

undetected · 132 days

discovery → filing · 17 weeks / 122 days

May 20, 2020

Begins

Sep 29, 2020

Discovered

Jan 29, 2021

Filed

vs. sector median

+10 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_45f4a53ec39553aa2021-01-29Verified
Montana State AGbd_b75de0a125a818fe2021-01-29Candidate
Indiana State AGbd_e21cfaecd65525662021-01-29Verified

Name: San Francisco Conservatory of Music
norm: san francisco conservatory of music

Name: San Francisco Conservatory of Music
norm: san francisco conservatory of music
Industry: Educationllm

Discovered: Sep 29, 2020
Breach occurred: May 20, 2020
Undetected for: 132 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 8, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Commenced an investigation to determine what, if any, sensitive SFCM data was potentially involved
Worked diligently to obtain further information from Blackbaud to understand the scope of the incident and the data that may have been affected
Reviewed internal records to compare the information provided by Blackbaud with internal records and confirm the identities and contact information for individuals whose personal information may have been impacted
Offering access to complimentary credit monitoring and identity protection services for 24 months through CyberScout
Changes made: Working to review existing policies and procedures regarding third-party vendors
Working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(122 days from discovery to filing)
Compliance flags: CA 60-day late · 101d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 29, 2020
→ Notified: Jan 8, 2021
101d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 29, 2020 → Notified: Jan 8, 2021	101d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJan 29 · first

Montana State AGJan 29 · first

Indiana State AGJan 29 · first

California State AGJan 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-537609
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2021
Raw hash: bacd637da4854a877eb30d8e6444dcb4a9bef9449fcd578e014a738cb4c4511c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySan Francisco Conservatory of Music

Victim entitySan Francisco Conservatory of Music

Incidentdiscovered Sep 29, 2020

Stated responseCommenced an investigation to determine what, if any, sensitive SFCM data was potentially involved

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov