New Communities, Inc.

On April 8, 2021, the Maine Office of the Attorney General disclosed a data breach affecting New Communities, Inc., stemming from a ransomware attack on Blackbaud, a third-party service provider. The breach was detected on February 25, 2021, and impacted 629 individuals, exposing highly sensitive personal information, including financial account numbers, Social Security numbers, and Medicaid numbers. The attack originated from Blackbaud’s systems, where threat actors encrypted data and exfiltrated unencrypted backups before demanding a ransom. While Blackbaud reportedly paid the ransom and received assurances of data destruction, the incident raised concerns over the long-term risks of identity theft, financial fraud, and unauthorized access to government-benefit records. The compromised data included personally identifiable information (PII) and protected health information (PHI), amplifying the severity due to the potential for sustained harm to affected individuals, including vulnerable populations reliant on Medicaid. The breach underscored vulnerabilities in third-party vendor security practices, particularly in sectors handling highly regulated data. New Communities, Inc. was among numerous organizations impacted by the Blackbaud incident, which affected nonprofits, healthcare providers, and educational institutions globally. The fallout included regulatory scrutiny, reputational damage, and the need for extensive remediation efforts, such as credit monitoring and identity protection services for victims.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6f892d35-2067-4764-82ed-38c8d21ccb72.shtml

TPRM report: https://www.rankiteo.com/company/new-comms-inc

"id": "new011083025",
"linkid": "new-comms-inc",
"type": "Ransomware",
"date": "5/2020",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'customers_affected': 629,
                        'name': 'New Communities, Inc.',
                        'type': 'non-profit organization'},
                       {'industry': 'cloud computing / software',
                        'name': 'Blackbaud',
                        'type': 'third-party vendor'}],
 'data_breach': {'number_of_records_exposed': 629,
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'high',
                 'type_of_data_compromised': ['financial account numbers',
                                              'Social Security numbers',
                                              'Medicaid numbers',
                                              'personally identifiable '
                                              'information (PII)']},
 'date_detected': '2021-02-25',
 'date_publicly_disclosed': '2021-04-08',
 'description': 'The Maine Office of the Attorney General reported a data '
                'breach involving New Communities, Inc. on April 8, 2021. The '
                'breach was discovered on February 25, 2021, after a '
                'ransomware attack on Blackbaud, which affected 629 '
                'individuals and potentially compromised personal information '
                'including financial account numbers, Social Security numbers, '
                'and Medicaid numbers.',
 'impact': {'data_compromised': ['financial account numbers',
                                 'Social Security numbers',
                                 'Medicaid numbers'],
            'identity_theft_risk': 'high',
            'payment_information_risk': 'high'},
 'ransomware': {'data_encryption': True},
 'references': [{'date_accessed': '2021-04-08',
                 'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': ['Maine Office of the '
                                                        'Attorney General']},
 'response': {'communication_strategy': 'public disclosure via Maine Office of '
                                        'the Attorney General'},
 'title': 'Data Breach at New Communities, Inc. via Blackbaud Ransomware '
          'Attack',
 'type': ['data breach', 'ransomware attack']}