MalwareOtherRansomwareRansom DemandedData ExfiltratedData EncryptedSupply Chain (3P Vendor)Identity (basic)Government IDMediumResolved

Ronald McDonald House of Dallas

bd_dd4181dafb498d10 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 14, 2021

To disclose

—

Affected

4state residents only

Linked

3 filings

Confidence

66%

Full breach record for Ronald McDonald House of Dallas →

Ronald McDonald House of Dallas notified Montana residents of a third-party breach involving Blackbaud. Unauthorized access occurred between Feb 7 and May 20, 2020. Backup files containing names and government IDs were exfiltrated. Blackbaud paid a ransom, confirmed data destruction, and fixed the vulnerability. RMHD discontinued using Blackbaud and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 7, 2020

Begins

Jan 14, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_144a89df0e5b8a272021-01-14Candidate
Indiana State AGbd_5cbe27232753f3ed2021-01-14Verified

Name: Ronald McDonald House of Dallas
norm: ronald mcdonald house of dallas

Name: Ronald McDonald House of Dallas
norm: ronald mcdonald house of dallas
Industry: Otherllm

Discovered: —
Breach occurred: Feb 7, 2020 – May 20, 2020
Materiality determined: —
Notification sent: Jan 11, 2020
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Blackbaud worked with law enforcement to conduct an investigation
Third party: via Blackbaud

During the incident: Conducted own investigation to understand the extent of the incident
Notifying affected individuals
Offering complimentary one-year membership of Experian’s IdentityWorks Credit 3B
No longer using Blackbaud to manage guest services
Reviewing how information is stored with third-party vendors
Changes made: Blackbaud identified and fixed the vulnerability associated with this incident
Blackbaud implemented several changes that will better protect data from any subsequent incidents
Blackbaud undertaking additional efforts to enhance their security processes
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJan 14 · first

Indiana State AGJan 14 · first

Montana State AGJan 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/rmhSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 14, 2021
Raw hash: 165600862d39b0bcfc90942373412104dc5d08c91306da12c4928453f5425caf

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityRonald McDonald House of Dallas

Victim entityRonald McDonald House of Dallas

IncidentThird-Party / Supply Chain

Stated responseConducted own investigation to understand the extent of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov