MalwareEducationFinancial ServicesEducationRansomwareData MishandlingRansom DemandedData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Ball State University Foundation

bd_f35bba88eff6975c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2020

Filed

Sep 23, 2020

To disclose

10 weeks

Affected · nationwide

184 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Ball State University Foundation →

Ball State University Foundation (BSUF) notified the NH AG of a breach involving third-party provider Blackbaud. A ransomware attack in May 2020 led to exfiltration of a subset of client data, including BSUF donor records containing names and SSNs/TINs. BSUF was notified on July 16, 2020. 18 individuals were affected, including 4 NH residents. BSUF is notifying affected individuals and reviewing its relationship with Blackbaud.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 76 days

discovery → filing · 10 weeks / 69 days

May 1, 2020

Begins

Jul 16, 2020

Discovered

Sep 23, 2020

Filed

vs. sector median

+1 wks slower

This filing is one of 4 about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_aa422e808a6378812020-09-24 · +1dVerified
Washington State AGbd_20c7a1434532117b2020-09-18 · +5dCandidate
Maine State AGbd_c14d5a473a7358052020-09-18 · +5dVerified

Name: DeFur Voran LLP
norm: defur voran

Name: Ball State University Foundation
norm: ball state university
Industry: EducationllmFinancial Servicesllm

Discovered: Jul 16, 2020
Breach occurred: May 1, 2020 – May 31, 2020
Undetected for: 76 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 18, 2020
Affected individuals: 18state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney General
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Notifying affected donors, vendors, friends, and alumni to make them aware of this breach of Blackbaud's systems so they can remain vigilant
Working with Blackbaud to understand why there was a delay between it finding the breach and notifying us, as well as what actions Blackbaud is taking to increase its security
Taking steps to learn how many other parties in the higher education and the wider not-for-profit sector have been affected
Exploring all options to ensure this does not happen again, including revisiting our relationship with Blackbaud
Changes made: Revisiting relationship with Blackbaud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGSep 18 · first

Maine State AGSep 18 · first

New Hampshire State AG+5d · this page

Massachusetts State AG+6d

Pattern: first filing Sep 18 (WA), last Sep 24 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ball-state-university-foundation-20200923.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2020
Raw hash: 37370e12cf308ce4913f4ac33934c7da80adbb165982ddb3f53296ac947f0793

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDeFur Voran LLP

Victim entityBall State University Foundation

Incidentdiscovered Jul 16, 2020

Stated responseNotifying affected donors, vendors, friends, and alumni to make them aware of this breach of Blackbaud's systems so they can remain vigilant

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov