MalwareEducationEducationRansomwareData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Blair Academy

bd_bbacafc73a0e39ea · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Dec 18, 2020

To disclose

22 weeks

Affected

12state residents only

Linked

5 filings

Confidence

66%

Full breach record for Blair Academy →

Blair Academy notified the New Hampshire Attorney General of a data event involving 12 state residents. A third-party vendor, Blackbaud, experienced a ransomware attack in May 2020, resulting in data exfiltration. Affected data included names, addresses, and Social Security numbers. Blair Academy provided 24 months of credit monitoring to affected individuals and is reviewing third-party vendor policies.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 22 weeks / 155 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Dec 18, 2020

Filed

vs. sector median

+12 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_092f1645e25ce0332020-12-09 · +9dVerified
Montana State AGbd_60b5bc8619fadf712020-12-09 · +9dVerified
Indiana State AGbd_87095805d52a23012020-12-09 · +9dVerified
Maine State AGbd_d147759e7ef2d1c82020-12-09 · +9dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Blair Academy
norm: blair academy
Domain: blair.edu
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020 – May 20, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 9, 2020
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the New Hampshire Attorney General
Initial access: supply_chain

During the incident: Worked with Blackbaud to understand the results of its investigation
Assessed the impact on Blair Academy data
Notified potentially affected individuals
Provided access to credit monitoring services for twenty-four (24) months through CyberScout
Encouraged impacted individuals to remain vigilant against incidents of identity theft and fraud
Provided information on how to place a fraud alert and security freeze on one's credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Encouraged individuals to contact the Federal Trade Commission, their state Attorney General, and law enforcement
Changes made: Reviewing existing policies and procedures regarding third-party vendors
Working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(155 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGDec 9 · first

Montana State AGDec 9 · first

Indiana State AGDec 9 · first

Maine State AGDec 9 · first

New Hampshire State AG+9d · this page

Pattern: first filing Dec 9 (MA), last Dec 18 (NH) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/blair-academy-20201218.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 18, 2020
Raw hash: 2aaeb543e896e99fbd1875ec3cc3f45b964135504e1ab1d0da2e9a1d71ffd7e1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityBlair Academy

Incidentdiscovered Jul 16, 2020

Stated responseWorked with Blackbaud to understand the results of its investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov