MalwareRansomwareSupply Chain (3P Vendor)Data ExfiltratedData EncryptedRansom PaidIDENTITY_BASICPIILowContained
Episcopal Community Services
bd_c71f3edde4f5d8d0 · schema v1 · pii pii-v1
Full breach record for Episcopal Community Services →Episcopal Community Services (ECS) notified California AG of a ransomware attack on third-party provider Blackbaud, Inc. The attack occurred between Feb 7 and May 20, 2020. ECS donor data (names, emails, addresses, giving history) was exfiltrated. No SSNs or financial account data were accessed. Blackbaud paid the ransom and ECS notified constituents on Aug 10, 2020.
California clockDiscovered Jul 16, 2020 → Notified Aug 10, 202025d ✓ CA 60-day OK9 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-194129
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 17, 2020
- Raw hash
- d25ef9809f3f1ece041292ab5b5bca96664eda12458b07684d883d0509df47d9
Reporting entity
- Name
- Episcopal Community Servicesnorm: episcopal community
- Domain
- ecscalifornia.org
Victim entity
- Name
- Episcopal Community Servicesnorm: episcopal community
- Domain
- ecscalifornia.org
Incident
- Discovered
- Jul 16, 2020
- Materiality determined
- Aug 10, 2020
- Notification sent
- Aug 10, 2020
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Third party
- via Blackbaud, Inc.
- Initial access
- supply_chain
Compliance
- Time to disclose
- 9 weeks(63 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 25d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 16, 2020→ Notified: Aug 10, 202025d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.