MalwareOtherRansomwareData MishandlingSupply Chain (3P Vendor)Ransom DemandedRansom PaidData ExfiltratedCustomer Data InvolvedIdentity (basic)FinancialLowContained

American Symphony Orchestra League

bd_f76174bc00cc6235 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 1, 2020

Filed

Oct 2, 2020

To disclose

9 weeks

Affected

161state residents only

Confidence

66%

Full breach record for American Symphony Orchestra League →4 incidents on file

American Symphony Orchestra League (dba League of American Orchestras) reported a third-party vendor breach involving Blackbaud. A ransomware attack in May 2020 led to exfiltration of donor data (names, addresses, phone, demographics, donation history) from 161 NH residents. Blackbaud paid ransom and confirmed data destruction. League notified donors and CRAs in Oct 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 92 days

discovery → filing · 9 weeks / 62 days

May 1, 2020

Begins

Aug 1, 2020

Discovered

Oct 2, 2020

Filed

vs. sector median

+2 wks slower

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed161 affectedView incident

Name: American Symphony Orchestra League
norm: american symphony orchestra league
Domain: americanorchestras.org

Name: American Symphony Orchestra League
norm: american symphony orchestra league
Domain: americanorchestras.org
Also named: American Symphony Orchestra Leaguedba oflegal entity
League of American Orchestrasdba oftrade name
Industry: Otherllm

Discovered: Aug 1, 2020
Breach occurred: May 1, 2020
Undetected for: 92 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 5, 2020
Affected individuals: 161state-resident count only
Data types: Identity (basic)Financial
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection Bureau

During the incident: League plans to notify its donors of the breach incident
Notification sent to all three Credit Reporting Agencies on 10/2/20
League seeking assurances from Blackbaud that additional measures are being taken
Changes made: Blackbaud implemented enhancements to access management
Blackbaud implemented network segmentation
Blackbaud deployed additional endpoint and network-based platforms
Testing by multiple third parties to ensure fix withstands all known attack tactics
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/american-symphony-orchestra-20201002.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2020
Raw hash: e82ba8bf0bfe4447b8a8cbdf781043d19d98fd1156386ce5f374e5d955e7837d

Reporting entityAmerican Symphony Orchestra League

Victim entityAmerican Symphony Orchestra League

Incidentdiscovered Aug 1, 2020

Stated responseLeague plans to notify its donors of the breach incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov