MalwareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedSupply Chain (3P Vendor)TargetedIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
Wilmington Friends School
bd_dfd1f158118b6afc · schema v1 · pii pii-v1
Full breach record for Wilmington Friends School →Wilmington Friends School (WFS) disclosed a ransomware incident involving its third-party vendor, Blackbaud. An unknown actor accessed Blackbaud systems in May 2020, exfiltrating data before being locked out on May 20, 2020. WFS was notified on September 29, 2020, and determined that Delaware residents' names, Social Security numbers, and tax identification numbers were accessible. WFS notified approximately 1,907 Delaware residents starting November 30, 2020, offering 24 months of credit monitoring.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_6f3eaa1ad7a59514Maine State AGfiled 2020-11-30Candidate
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/12/Exhibit-1-Wilmington-Friends-School-DE.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 30, 2020
- Raw hash
- 80da8e2192b34c733260619906429a9e608723f03470575e3c21d30aaf3e83e1
Reporting entity
- Name
- Wilmington Friends Schoolnorm: wilmington friends school
Victim entity
- Name
- Wilmington Friends Schoolnorm: wilmington friends school
Incident
- Discovered
- Sep 29, 2020
- Materiality determined
- —
- Notification sent
- Nov 30, 2020
- Affected individuals
- 1,907
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified relevant regulatory authorities
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 weeks(62 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.