HackingEducationEducationSupply Chain (3P Vendor)Data ExfiltratedGovernment IDPIIHighContained

St. Mark's School of Texas

bd_fdb4ecaa8878724d · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 27, 2020

Filed

Jun 17, 2021

To disclose

38 weeks

Affected · nationwide

5,6761 in this filing

Linked

4 filings

Confidence

64%

Full breach record for St. Mark's School of Texas →2 incidents on file

St. Mark's School of Texas reported a data breach involving its third-party vendor, Blackbaud, Inc. The incident occurred on May 14, 2020, and was discovered on September 27, 2020. The breach compromised names and Social Security Numbers of 5,676 individuals, including one Maine resident. Notification was sent on June 8, 2021, offering 24 months of credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 27, 2020 → Filed with AG Jun 17, 2021263d ✗ ME AG >90d38 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 136 days

discovery → filing · 38 weeks / 263 days

May 14, 2020

Begins

Sep 27, 2020

Discovered

Jun 17, 2021

Filed

This filing is one of 4 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_8dd999d883da6f8c2021-06-22 · +5dVerified
Indiana State AGbd_121f5041a2d1ce212021-06-08 · +9dVerified
Montana State AGbd_919ba6ace5407df02021-06-08 · +9dCandidate

Name: St. Mark's School of Texas
norm: st mark s school of texas
Domain: smtexas.org

Name: St. Mark's School of Texas
norm: st mark s school of texas
Domain: smtexas.org
Industry: Educationllm

Discovered: Sep 27, 2020
Breach occurred: May 14, 2020
Undetected for: 136 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 8, 2021
Affected individuals: 5,676state + nationwide
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Filed data breach notice with Maine Attorney General
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Provided 24 months of credit monitoring and fraud assistance from CyberScout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(263 days from discovery to filing)
Compliance flags: ME AG >90d · 263dME resident >180d · 254d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 27, 2020
→ Filed with AG: Jun 17, 2021
263d 90 days ME AG >90d
Maine
Discovered: Sep 27, 2020
→ Notified: Jun 8, 2021
254d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 27, 2020 → Filed with AG: Jun 17, 2021	263d	90 days	ME AG >90d
Maine	Discovered: Sep 27, 2020 → Notified: Jun 8, 2021	254d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJun 8 · first

Montana State AGJun 8 · first

Maine State AG+9d · this page

Massachusetts State AG+14d

Pattern: first filing Jun 8 (IN), last Jun 22 (MA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1b8355a3-f31e-44f4-b107-b21ba954ba19.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 17, 2021
Raw hash: 90156fdd57448123ee2d02b61d24ca1ce247da05ef04813a733d4922c603e023

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySt. Mark's School of Texas

Victim entitySt. Mark's School of Texas

Incidentdiscovered Sep 27, 2020

Stated responseProvided 24 months of credit monitoring and fraud assistance from CyberScout

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov