MalwareHealthcareHealthcareRansomwareCapture Stored DataSupply Chain (3P Vendor)Ransom DemandedData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)LowResolved

Emanate Health Foundation

bd_b3ca2988bd532617 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Sep 11, 2020

To disclose

—

Affected

Not disclosed

Confidence

83%

Full breach record for Emanate Health Foundation →2 incidents on file

Emanate Health Foundation notified California residents of a ransomware attack on its third-party provider Blackbaud. The cybercriminal accessed a Foundation backup file hosted on Blackbaud's servers between February 7, 2020 and May 20, 2020, exfiltrating data including names, addresses, birthdates, gender, phone numbers, emails, and hospital department locations. No SSNs, credit card, or bank account data were involved.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 7, 2020

Begins

Sep 11, 2020

Filed

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Emanate Health Foundation
norm: emanate health

Name: Emanate Health Foundation
norm: emanate health
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 7, 2020 – May 20, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Blackbaud retained independent forensics experts
Blackbaud notified law enforcement
Blackbaud expelled the cybercriminal from its system
Blackbaud confirmed that the backup file copy had been destroyed
Blackbaud hired a third-party team of experts to monitor the dark web for any further misuse of the data
Changes made: Blackbaud identified the vulnerability associated with this incident, including the tactics used by the cybercriminal, and has taken actions to fix it
Blackbaud is accelerating its efforts to further harden its environment through enhancements to access management, network segmentation, deployment of additional endpoint, and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194003
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2020
Raw hash: 83263fc4ebba70c1f8666a175c87f1680119ed524bb60de41914677609bbf3af

Reporting entityEmanate Health Foundation

Victim entityEmanate Health Foundation

IncidentRansomware

Stated responseBlackbaud retained independent forensics experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov