MalwareEducationEducationRansomwareData ExfiltratedData EncryptedRansom DemandedSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)Financial accountHighContained

Holderness School

bd_a954f6b831109e3d · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 16, 2020

Filed

Mar 2, 2021

To disclose

33 weeks

Affected

1,112state residents only

Linked

4 filings

Confidence

66%

Full breach record for Holderness School →

Holderness School notified the New Hampshire Attorney General of a ransomware attack on its vendor, Blackbaud, Inc. Unauthorized access to Blackbaud's network occurred between February 7 and May 20, 2020. Backup files containing donor information (names, SSNs, tax IDs, financial account numbers) for 1,112 New Hampshire residents were exfiltrated. Holderness School mailed notifications on March 1, 2021, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 33 weeks / 229 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Mar 2, 2021

Filed

vs. sector median

+24 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_322a06c8f7bff71f2021-03-01 · +1dVerified
Maine State AGbd_33ad046cd66f8d752021-03-01 · +1dCandidate
Massachusetts State AGbd_fce35c5de2aad0d42021-03-01 · +1dVerified

Name: Holderness School
norm: holderness school

Name: Holderness School
norm: holderness school
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 1, 2021
Affected individuals: 1,112state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Gordon MacDonald
Initial access: supply_chain

During the incident: Launched its own investigation to identify the individuals whose information may have been involved
Mailing notification letters to the New Hampshire residents via United States Postal Service First-Class mail
Offering the New Hampshire residents complimentary, two-year memberships to credit monitoring and identity theft prevention services through CyberScout
Established a dedicated phone number where the individual may obtain more information regarding the incident
Changes made: Re-evaluating its relationship with Blackbaud
Reviewing the security requirements it has for its data solution service vendors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(229 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMar 1 · first

Maine State AGMar 1 · first

Massachusetts State AGMar 1 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/holderness-school-20210302.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2021
Raw hash: c784e045196f8df7b77666ed4d39c776386e886a3790c435987767e974bcaedb

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHolderness School

Victim entityHolderness School

Incidentdiscovered Jul 16, 2020

Stated responseLaunched its own investigation to identify the individuals whose information may have been involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov