MalwareEducationEducationRansomwareExtortion DemandSupply Chain (3P Vendor)Ransom DemandedData ExfiltratedTargetedIdentity (basic)Financial accountLowContained

The Alfred & Adele Davis Academy, Inc.

bd_cf29347c24c1875a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Oct 20, 2020

To disclose

14 weeks

Affected

1state residents only

Confidence

66%

Full breach record for The Alfred & Adele Davis Academy, Inc. →

The Alfred & Adele Davis Academy notified the NH AG of a third-party breach involving Blackbaud. A threat actor exfiltrated data between Feb 7 and May 20, 2020, during an attempted ransomware attack. Data included names and bank account info for 1 NH resident. Notification sent Oct 14, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 14 weeks / 96 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Oct 20, 2020

Filed

vs. sector median

+5 wks slower

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: The Alfred & Adele Davis Academy, Inc.
norm: the alfred adele davis academy

Name: The Alfred & Adele Davis Academy, Inc.
norm: the alfred adele davis academy
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 14, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Third party: via Blackbaud

During the incident: Engaged cybersecurity professionals experienced in handling these types of incidents
Provided written notification to the affected resident
Advised the affected resident about the process for placing fraud alerts and/or security freezes on credit files
Advised the affected resident to contact their financial institutions
Changes made: Blackbaud closed the vulnerability that allowed the incident
Blackbaud is enhancing their security controls
Blackbaud is conducting ongoing efforts against incidents like this in the future
Davis Academy continually evaluates and modifies its practices and those of its third party service providers to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(96 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/alfred-adele-davis-academy-20201020.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2020
Raw hash: dd7133f8598e52fdef36582c4cd16b30d3f419932202a340fa942219480c5807

Reporting entityThe Alfred & Adele Davis Academy, Inc.

Victim entityThe Alfred & Adele Davis Academy, Inc.

Incidentdiscovered Jul 16, 2020

Stated responseEngaged cybersecurity professionals experienced in handling these types of incidents

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov