MalwareEducationEducationRansomwareData ExfiltratedData EncryptedRansom DemandedSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)MediumContained

Kents Hill School

bd_b7eb55ee5280e806 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Jan 8, 2021

To disclose

25 weeks

Affected

50state residents only

Linked

3 filings

Confidence

66%

Full breach record for Kents Hill School →2 incidents on file

Kents Hill School notified the New Hampshire Attorney General of a security incident involving its vendor, Blackbaud, Inc. Unauthorized access to Blackbaud's systems occurred between February 7, 2020, and May 20, 2020. The incident involved an attempted ransomware attack where backup files containing donor names and Social Security numbers were exfiltrated. Kents Hill School notified 50 New Hampshire residents on January 7, 2021, offering two years of credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 25 weeks / 176 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Jan 8, 2021

Filed

vs. sector median

+17 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_5dc6c2dcedf833b92021-01-07 · +1dVerified
Maine State AGbd_927ae0da37f285062021-01-07 · +1dCandidate

Name: Kents Hill School
norm: kents hill school

Name: Kents Hill School
norm: kents hill school
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 7, 2021
Affected individuals: 50state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Gordon MacDonald
Third party: via Blackbaud, Inc.
Initial access: exploit_public_facing

During the incident: Launched its own investigation and worked with Blackbaud to identify the individuals whose information may have been involved
Provided written notice to 50 New Hampshire residents by mailing letters via United States Postal Service First-Class mail
Offered the New Hampshire residents complimentary, two-year memberships to credit monitoring and identity theft prevention services through CyberScout
Established a dedicated phone number where the individuals may obtain more information regarding the incident
Changes made: Blackbaud identified and fixed the vulnerability associated with this incident
Implemented several changes that will better protect data
Undertaking additional efforts to improve the security of its environment through enhancements to access management, network segmentation, and deployment of additional endpoint and network based platforms
Kents Hill School is undertaking a review of how its information is stored with Blackbaud and evaluating its security safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(176 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJan 7 · first

Maine State AGJan 7 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kents-hill-20210108.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 8, 2021
Raw hash: 7f26d510c900ada4bf2274afb2b97e8cb958de4e4af0fddac78809e7f1b21b0a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKents Hill School

Victim entityKents Hill School

Incidentdiscovered Jul 16, 2020

Stated responseLaunched its own investigation and worked with Blackbaud to identify the individuals whose information may have been involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov