MalwareOtherRansomwareSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedIdentity (basic)PIIMediumActive

The Jane Goodall Institute

bd_b6241a8868310c3e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 24, 2020

Filed

Sep 1, 2020

To disclose

6 weeks

Affected

1,082state residents only

Linked

3 filings

Confidence

65%

Full breach record for The Jane Goodall Institute →3 incidents on file

The Jane Goodall Institute notified South Carolina of a third-party vendor breach involving Blackbaud. A ransomware attack on Blackbaud resulted in the exfiltration of donor PII (names, contact info). No financial or SSN data was compromised. The Institute is conducting an independent inquiry.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 6 weeks / 39 days

Jul 24, 2020

Discovered

Sep 1, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_a3b53ae81d5b86022020-09-02 · +1dVerified
Indiana State AGbd_3ae316f4cc2fb5ab2020-07-31 · +32dVerified

Name: The Jane Goodall Institute
norm: the jane goodall institute
Domain: janegoodall.org

Name: The Jane Goodall Institute
norm: the jane goodall institute
Domain: janegoodall.org
Industry: Otherllm

Discovered: Jul 24, 2020
Materiality determined: —
Notification sent: Jul 31, 2020
Affected individuals: 1,082state-resident count only
Data types: Identity (basic)PII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Conducting an independent inquiry into this incident
Actively investigating the cause of the incident
Exploring all options to ensure this does not happen again, including the possibility of using a provider other than Blackbaud going forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJul 31 · first

South Carolina State AG+32d · this page

New Hampshire State AG+33d

Pattern: first filing Jul 31 (IN), last Sep 2 (NH) — a 33-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/JaneGoodallInstitute.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2020
Raw hash: c80d689116915c0e4849fc9287be7028a363eb838fbe3ebfa4e5ea141b673352

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityThe Jane Goodall Institute

Victim entityThe Jane Goodall Institute

Incidentdiscovered Jul 24, 2020

Stated responseConducting an independent inquiry into this incident

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov