MalwareEducationEducationRansomwareRansom DemandedData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)PIIMediumContained

Heritage University

bd_f1567c17f40f21e7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Aug 10, 2020

To disclose

25 days

Affected

7,803state residents only

Linked

2 filings

Confidence

70%

Full breach record for Heritage University →

Heritage University notified Washington AG of a ransomware attack on third-party vendor Blackbaud. Attackers exfiltrated names and DOBs of 7,803 Washington residents. Data was encrypted and ransom paid. Notification sent within 30 days of discovery.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d25 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 160 days

discovery → filing · 25 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Aug 10, 2020

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_758e3f04bf518c212020-08-07 · +3dVerified

Name: Heritage University
norm: heritage university

Name: Heritage University
norm: heritage university
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 10, 2020
Affected individuals: 7,803state-resident count only
Data types: Identity (basic)PII
Data elements: NameDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Attorney General
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Notified affected individuals
Notified Washington State Attorney General
Hired a third-party team of experts to monitor for data
Actively taking steps to reduce any future risk by ensuring personal identifiable information that is not necessary is removed across all university systems
Changes made: Ensuring personal identifiable information that is not necessary is removed across all university systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGAug 7 · first

Washington State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 10, 2020
Raw hash: a1657ab56b8c258fbc48f30d664a7d5556b50cfe8f6be3e14d32f6cf54a5c857

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHeritage University

Victim entityHeritage University

Incidentdiscovered Jul 16, 2020

Stated responseNotified affected individuals

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com