MalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedRansom DemandedSupply Chain (3P Vendor)Identity (basic)Health (basic)LowContained

Saint Luke's Foundation

bd_a719806d5eb32ec0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Aug 20, 2020

To disclose

5 weeks

Affected

62state residents only

Linked

3 filings

Confidence

66%

Full breach record for Saint Luke's Foundation →

Saint Luke's Foundation notified Montana AG of a ransomware incident involving third-party vendor Blackbaud. Attack occurred Feb 7 - May 20, 2020. Compromised data included patient demographics, contact info, DOB, and limited medical info. No SSN or financial data accessed. Blackbaud contained the incident and deleted the backup file.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 5 weeks / 35 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Aug 20, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_40681e258ce07a602020-08-20Verified
HHS OCRbd_5bcfb721c1a28b412020-08-20Verified

Name: Saint Luke's Foundation
norm: saint luke s

Name: Saint Luke's Foundation
norm: saint luke s
Industry: Healthcarellm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 62state-resident count only
Data types: Identity (basic)Health (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Blackbaud identified the vulnerability associated with this incident
Blackbaud has taken actions to fix it
Blackbaud is accelerating their efforts to further harden their environment through enhancements to access management, network segmentation, deployment of additional endpoint, and network-based platforms
Blackbaud has hired a third-party team of experts to monitor the dark web for any further misuse of the data
Changes made: Enhancements to access management
Network segmentation
Deployment of additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGAug 20 · first

HHS OCRAug 20 · first

Montana State AGAug 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Saint-Lukes-Foundation-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2020
Raw hash: 525f83bd1bfd7395437570a9854d78a4e4a371d4b2df05db912d55c717561ed1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySaint Luke's Foundation

Victim entitySaint Luke's Foundation

Incidentdiscovered Jul 16, 2020

Stated responseBlackbaud identified the vulnerability associated with this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov