HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

Friends of Bassett Healthcare Network

bd_a1796a94ee7968ae · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 2, 2020

Filed

Nov 9, 2020

To disclose

5 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Friends of Bassett Healthcare Network →

Friends of Bassett Healthcare Network (FBHN) notified the NH Attorney General of a data breach involving its third-party vendor, Blackbaud, Inc. Unauthorized access occurred between Feb 7 and May 20, 2020. FBHN discovered on Oct 2, 2020, that a backup of its fundraising database was accessed. One NH resident was affected, with data including SSN, name, DOB, and bank account/routing numbers. FBHN mailed notification on Nov 6, 2020, and offered 12 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 238 days

discovery → filing · 5 weeks / 38 days

Feb 7, 2020

Begins

Oct 2, 2020

Discovered

Nov 9, 2020

Filed

vs. sector median

10 wks faster

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Friends of Bassett Healthcare Network
norm: friends of bassett healthcare network

Name: Friends of Bassett Healthcare Network
norm: friends of bassett healthcare network
Industry: Professional Servicesllm

Discovered: Oct 2, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 238 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 6, 2020
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Gordon MacDonald
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Mailed a notification letter to the New Hampshire resident
Offered the individual twelve months of complimentary identity monitoring services through Experian
Reviewing its relationship with Blackbaud and evaluating its security safeguards
Changes made: Reviewing its relationship with Blackbaud and evaluating its security safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/friends-bassett-healthcare-network-20201109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2020
Raw hash: e86add9dd0a2ac8049f78fd324235e0ea1e32638af0293dad42d3fd82b44410d

Reporting entityFriends of Bassett Healthcare Network

Victim entityFriends of Bassett Healthcare Network

Incidentdiscovered Oct 2, 2020

Stated responseMailed a notification letter to the New Hampshire resident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov