MalwareEducationEducationRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Cambridge School of Weston

bd_e3420dba26490dc0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Dec 1, 2020

To disclose

20 weeks

Affected

7state residents only

Linked

3 filings

Confidence

66%

Full breach record for Cambridge School of Weston →

Cambridge School of Weston reported a data security incident involving its vendor, Blackbaud. A ransomware attack occurred between February 7, 2020, and May 20, 2020. The school notified the New Hampshire Attorney General on December 1, 2020, that seven New Hampshire residents' personal information (including SSNs and DOBs) may have been compromised. The school offered two years of credit monitoring and identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 20 weeks / 138 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Dec 1, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_a419708b97b9333b2020-11-25 · +6dVerified
Maine State AGbd_be33894dcd6dbea52020-11-25 · +6dCandidate

Name: Cambridge School of Weston
norm: cambridge school of weston

Name: Cambridge School of Weston
norm: cambridge school of weston
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 25, 2020
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection and Antitrust Bureau
Initial access: supply_chain

During the incident: Provided written notice to affected individuals via U.S. mail
Offered complimentary, two-year subscription for identity theft protection services from CyberScout
Notified the New Hampshire Attorney General
Continued to actively monitor the situation and follow-up with Blackbaud
Ensured Blackbaud implemented fixes and hardened its environment
Changes made: Blackbaud confirmed through testing by multiple third parties that its fix withstands all known attack tactics
Blackbaud accelerated efforts to further harden its environment through enhancements to access management
Blackbaud implemented network segmentation
Blackbaud deployed additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(138 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 25 · first

Maine State AGNov 25 · first

New Hampshire State AG+6d · this page

Pattern: first filing Nov 25 (MA), last Dec 1 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cambridge-school-weston-20201201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2020
Raw hash: 6ba5913df18365272c1e5866dd9c0f6a62f3ae38b1055ceffe1507bb8586b851

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCambridge School of Weston

Victim entityCambridge School of Weston

Incidentdiscovered Jul 16, 2020

Stated responseProvided written notice to affected individuals via U.S. mail

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov