MalwareRansomwareData ExfiltratedRansom DemandedRansom PaidSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowResolved

Museum of Contemporary Art Santa Barbara

bd_d31d869e2763cb5c · schema v1 · pii pii-v1

Severity

Low

Discovered

May 1, 2020

Filed

Aug 4, 2020

To disclose

14 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Museum of Contemporary Art Santa Barbara →

Museum of Contemporary Art Santa Barbara was affected by a ransomware attack on its service provider, Blackbaud, in May 2020. The attacker exfiltrated a backup of the museum's eTapestry data but did not access credit card, bank account, or SSN information. Blackbaud paid the ransom to ensure destruction of the stolen data and expelled the attacker. The incident is resolved.

J jump to incidentP pin to compareR raw source

Incident timeline

May 31, 2020

Begins

Aug 4, 2020

Filed

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Museum of Contemporary Art Santa Barbara
norm: museum of contemporary art santa barbara

Name: Museum of Contemporary Art Santa Barbara
norm: museum of contemporary art santa barbara

Discovered: May 1, 2020
Breach occurred: May 31, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Blackbaud

During the incident: Successfully prevented the cybercriminal from blocking our system access and fully encrypting files
Expelled them from our system
Paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed
Hired a third-party team of experts to monitor the dark web
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(95 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192717
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2020
Raw hash: 8a7f5d29e182f2ded8dea4cf3e50e31830188bd623399bcb496454cdd25fd93f

Reporting entityMuseum of Contemporary Art Santa Barbara

Victim entityMuseum of Contemporary Art Santa Barbara

Incidentdiscovered May 1, 2020

Stated responseSuccessfully prevented the cybercriminal from blocking our system access and fully encrypting files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov