MalwareEducationEducationRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Bridgewater State University

bd_aa15326f63c174a2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Aug 28, 2020

To disclose

6 weeks

Affected

5state residents only

Linked

2 filings

Confidence

64%

Full breach record for Bridgewater State University →6 incidents on file

Bridgewater State University notified affected individuals of a ransomware incident impacting third-party vendor Blackbaud, Inc. in May 2020. The incident exposed names and Social Security numbers of alumni and donors. The university offered one year of Experian IdentityWorks credit monitoring and purged the affected SSN data from the system.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 6 weeks / 43 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Aug 28, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_473b3132226f47b92020-10-01 · +34dVerified

Name: Bridgewater
norm: bridgewater
Domain: bridgewater.com

Name: Bridgewater State University
norm: bridgewater state university
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2020
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Offering a complimentary one-year membership of Experian IdentityWorks SM Credit 3B
Reviewed internal records to identify who may have been affected
Worked with Blackbaud to obtain additional information about the nature of the event
Purged Social Security number information from the system
Changes made: Reviewing relationship with Blackbaud
Reviewing technical controls Blackbaud has in place for securing data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGAug 28 · first · this page

New Hampshire State AG+34d

Pattern: first filing Aug 28 (MT), last Oct 1 (NH) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Bridgewater-State-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2020
Raw hash: d0f8a04cfd64f8fbdfa88d462f32aae5dc532bc6d9603136ee32ba500888d178

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBridgewater

Victim entityBridgewater State University

Incidentdiscovered Jul 16, 2020

Stated responseOffering a complimentary one-year membership of Experian IdentityWorks SM Credit 3B

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov