MalwareEducationTechnologyEducationRansomwareData MishandlingRansom DemandedRansom PaidData ExfiltratedData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumResolved

Blackbaud, Inc.

bd_c8f979041c90ba3c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Jan 21, 2021

To disclose

27 weeks

Affected

46state residents only

Confidence

66%

St. Paul's School notified Montana residents of a ransomware incident at vendor Blackbaud, Inc. Unauthorized access occurred Feb 7–May 20, 2020. Backup files containing names and SSNs were exfiltrated. Blackbaud paid a ransom and destroyed files. St. Paul's offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 27 weeks / 189 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Jan 21, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed46 affectedView incident

Name: ST. PAUL'S SCHOOL
norm: st paul s school

Name: Blackbaud, Inc.
norm: blackbaud
Industry: EducationllmTechnologyllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 46state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Blackbaud reported that it has been working with law enforcement

During the incident: Blackbaud identified and fixed the vulnerability associated with this incident
Blackbaud implemented several changes that will better protect your data from any subsequent incidents
Blackbaud undertaking additional efforts to harden their environment through enhancements to access management, network segmentation, and deployment of additional endpoint and network-based platforms
St. Paul's School conducted its own investigation of the Blackbaud services
Offering complimentary membership of Experian’s IdentityWorks
Changes made: Blackbaud identified and fixed the vulnerability associated with this incident
Blackbaud implemented several changes that will better protect your data from any subsequent incidents
Blackbaud undertaking additional efforts to harden their environment through enhancements to access management, network segmentation, and deployment of additional endpoint and network-based platforms
St. Paul's School will continually assess its internal data management policies and practices to protect personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(189 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/spsSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 21, 2021
Raw hash: 949b9abc0dd76359be4bfc352dc87f995e7b9844c9e60b0ce7880141d562f3d3

Reporting entityST. PAUL'S SCHOOL

Victim entityBlackbaud, Inc.

Incidentdiscovered Jul 16, 2020

Stated responseBlackbaud identified and fixed the vulnerability associated with this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov