HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumResolved
Cambridge School of Weston
bd_be33894dcd6dbea5 · schema v1 · pii pii-v1
Full breach record for Cambridge School of Weston →Cambridge School of Weston reported a third-party vendor breach involving Blackbaud. The incident occurred on February 7, 2020, and was discovered on November 9, 2020. Personal information including names and Social Security Numbers was compromised for 563 individuals total, including 6 Maine residents. The school provided 24 months of credit monitoring via CyberScout.
Maine clockDiscovered Nov 9, 2020 → Filed with AG Nov 25, 202016d ✓ ME AG ≤30d16 days discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed563 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c557b782-b560-4aad-94f9-5b79a81a9024.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 25, 2020
- Raw hash
- 2a17be6562f644b8a84c26ca649dd9521567ab7cf43746c98dfd9ec5a22031fb
Reporting entity
- Name
- Cambridge School of Westonnorm: cambridge school of weston
Victim entity
- Name
- Cambridge School of Westonnorm: cambridge school of weston
Incident
- Discovered
- Nov 9, 2020
- Materiality determined
- —
- Notification sent
- Nov 25, 2020
- Affected individuals
- 563
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Filed data breach notice with the Maine Attorney General
- Third party
- via Blackbaud
- Initial access
- supply_chain
Compliance
- Time to disclose
- 16 days(16 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 16d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Nov 9, 2020→ Filed with AG: Nov 25, 202016d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.