MalwareOtherRansomwareRansom DemandedData ExfiltratedSupply Chain (3P Vendor)Multi-Stage ChainIdentity (basic)Financial accountLowActive

Direct Relief

bd_f1aced38a63e21be · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 16, 2020

Filed

Apr 28, 2021

To disclose

41 weeks

Affected

926state residents only

Confidence

69%

Full breach record for Direct Relief →

Direct Relief notified the Washington AG of a third-party breach involving Blackbaud. A threat actor exfiltrated data from Blackbaud's systems between Feb 7 and May 20, 2020, and attempted a ransomware attack on May 20. Direct Relief was notified by Blackbaud on July 16, 2020. Data potentially included names, DOBs, and financial account numbers for 926 Washington residents. Direct Relief engaged forensic experts and is notifying affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 41 weeks / 286 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Apr 28, 2021

Filed

vs. sector median

+33 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed926 affectedView incident

Name: Direct Relief
norm: direct relief

Name: Direct Relief
norm: direct relief
Industry: Otherllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2021
Affected individuals: 926state-resident count only
Data types: Identity (basic)Financial account
Data elements: NameFinancial account numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 400-499dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Consumer Protection Division
Third party: via Blackbaud
Initial access: supply_chain

During the incident: Commenced an immediate and thorough investigation
Engaged cybersecurity professionals experienced in handling these types of incidents
Providing the affected residents with written notification of this incident
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files and obtaining free credit reports
Changes made: Blackbaud closed the vulnerability that allowed the incident
Blackbaud is enhancing their security controls and conducting ongoing efforts against incidents like this in the future
Direct Relief continually evaluates and modifies their practices, and those of third-party service providers, to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(286 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10452.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2021
Raw hash: 564243f6f8fb1353fe532405705cd729bad6d7e693cfc9416ad6cc916beb9479

Reporting entityDirect Relief

Victim entityDirect Relief

Incidentdiscovered Jul 16, 2020

Stated responseCommenced an immediate and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com