MalwareGovernmentGovernmentRansomwareRansom DemandedRansom PaidData ExfiltratedSupply Chain (3P Vendor)Government IDFinancial accountIdentity (basic)HighContained

Thrive Upstate

bd_d93a7c4a7b8e4125 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 30, 2020

Filed

Dec 28, 2020

To disclose

8 weeks

Affected

2,700state residents only

Confidence

65%

Full breach record for Thrive Upstate →

Thrive Upstate notified South Carolina residents of a ransomware attack on third-party provider BlackBaud, Inc. in 2020. The attacker exfiltrated a backup file containing names, SSNs, addresses, and bank account information before being expelled. Thrive Upstate paid the ransom and provided 24 months of credit monitoring and fraud resolution services to affected individuals.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due8 weeks discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

discovery → filing · 8 weeks / 59 days

Oct 30, 2020

Discovered

Dec 28, 2020

Filed

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,700 affectedView incident

Name: Thrive Upstate
norm: thrive upstate

Name: Thrive Upstate
norm: thrive upstate
Industry: Governmentllm

Discovered: Oct 30, 2020
Materiality determined: —
Notification sent: Oct 30, 2020
Affected individuals: 2,700state-resident count only
Data types: Government IDFinancial accountIdentity (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via BlackBaud, Inc.

During the incident: Engaged independent forensics experts
Notified law enforcement
Expelled cybercriminal from system
Paid cybercriminal's demand
Provided access to Single Bureau Credit Monitoring services at no charge for 24 months
Provided proactive fraud assistance through CyberScout
Changes made: Paid cybercriminal's demand with confirmation that the copy removed had been destroyed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/ThriveUpstate.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 28, 2020
Raw hash: 64595c8b56184cba74e32718135984ebbd2462aac1276013b2390951c4154d7a

Reporting entityThrive Upstate

Victim entityThrive Upstate

Incidentdiscovered Oct 30, 2020

Stated responseEngaged independent forensics experts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov