MalwareRansomwareSupply Chain (3P Vendor)Ransom DemandedData ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICHEALTH_BASICLowContained
Polycystic Kidney Disease Foundation
bd_b57c6e4ad281bdde · schema v1 · pii pii-v1
Full breach record for Polycystic Kidney Disease Foundation →Polycystic Kidney Disease Foundation (PKD Foundation) notified California AG of a data breach involving its third-party vendor, Blackbaud. A ransomware attack on Blackbaud in May 2020 resulted in the exfiltration of a subset of PKD Foundation constituent data, including names, contact details, philanthropic interests, and transplant status. Blackbaud paid the ransom and destroyed the data. PKD Foundation is notifying affected individuals and monitoring for misuse.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_3c4211f7da1c5a0fOregon State AGfiled 2020-09-04Verified
- bd_aacdada4b0a038fdMontana State AGfiled 2020-09-04Verified
- bd_f7d100553c531787Delaware State AGfiled 2020-09-04Verified
- bd_2e56f6d9b3a2f1baWashington State AGfiled 2020-09-03(1d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-193798
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 4, 2020
- Raw hash
- 947ef40efa40c733fbfd00476ed8776f678762a0057eaa449b06b5c9204bdf92
Reporting entity
- Name
- Polycystic Kidney Disease Foundationnorm: polycystic kidney disease
- Domain
- pkdcure.org
Victim entity
- Name
- Polycystic Kidney Disease Foundationnorm: polycystic kidney disease
- Domain
- pkdcure.org
Incident
- Discovered
- Jul 16, 2020
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICHEALTH_BASIC
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Third party
- via Blackbaud
- Initial access
- supply_chain
Compliance
- Time to disclose
- 7 weeks(50 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.