The Washington State University Foundation fell victim to a prolonged ransomware attack between February 7, 2020, and May 20, 2020, compromising the personal data of 334,219 Washington residents. The exposed information included names and dates of birth, though no financial or highly sensitive records (e.g., Social Security numbers) were reported as stolen. The breach was detected later by Blackbaud, a third-party service provider, on July 16, 2020, with notifications to affected individuals issued on August 20, 2020. The incident highlights vulnerabilities in third-party vendor security, as the attack exploited weaknesses in Blackbaud’s systems, which the foundation relied upon. While the foundation claimed no evidence of misuse of the exposed data, the sheer scale of affected individuals—primarily customers (donors/alumni)—raises concerns over potential identity theft, phishing risks, or long-term reputational damage. The delayed discovery and response further compounded the impact, underscoring gaps in real-time threat detection and crisis communication.