Blackbaud on Data Breach: Nothing to see here, move along

In May of 2020, we discovered and stopped a ransomware attack. In a ransomware attack, cybercriminals attempt to disrupt the business by locking companies out of their own data and servers. After discovering the attack, our Cyber Security team—together with independent forensics experts and law enforcement—successfully prevented the cybercriminal from blocking our system access and fully encrypting files; and ultimately expelled them from our system. Prior to our locking the cybercriminal out, the cybercriminal removed a copy of a subset of data from our self-hosted environment. The cybercriminal did not access credit card information, bank account information, or social security numbers. Because protecting our customers’ data is our top priority, we paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed. Based on the nature of the incident, our research, and third party (including law enforcement) investigation, we have no reason to believe that any data went beyond the cybercriminal, was or will be misused; or will be disseminated or otherwise made available publicly. This incident did not involve solutions in our public cloud environment (Microsoft Azure, Amazon Web Services), nor did it involve the majority of our self-hosted environment. The subset of customers who were part of this incident have been notified and supplied with additional information and resources. We apologize that this happened and will continue to do our very best to supply help and support as we and our customers jointly navigate this cybercrime incident.

But a source has told the BBC that in some cases it involved donors details including:

– names, ages and addresses

– car licence details

– employers

– estimated wealth and identified assets

– total number and value of past donations to the organisation in question

– wider history of philanthropic and political gifts

– spouses’ identity and past gift-giving

– likelihood to make a bequest triggered by their death

Although Blackbaud has said the cyber-criminals had provided confirmation that the stolen data was destroyed, one expert questioned whether such an assurance could be trusted.

“The hackers would know these people have a propensity to support good causes,” commented Pat Walshe from the consultancy Privacy Matters.

This would be valuable information to fraudsters, he added, who could use it to fool victims into thinking they were making further donations when in fact they would be giving away their payment card details.

The statement goes on to say Blackbaud paid the ransom demand. Doing so is not illegal, but goes against the advice of numerous law enforcement agencies, including the FBI, NCA and Europol.

Blackbaud said once the hackers had been paid, they had given “confirmation that the copy [of data] they removed had been destroyed”.

“It is worrying that the supplier paid the ransom as, arguably, this encourages future attacks and doesn’t overcome the fact that data has been compromised. This demonstrates the multiplier effect of supply chain hacks and reinforces the advice that security needs to be a collaborative exercise,” Cath Goulding, chief information security officer at cyber-security firm Nominet said.

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

The processor shall notify the controller without undue delay after becoming aware of a personal data breach.

The notification referred to in paragraph 1 shall at least:

1. describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

2. communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

3. describe the likely consequences of the personal data breach;

4. describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. (California Civil Code s. 1798.29(a) [agency] and California Civ. Code s. 1798.82(a) [person or business].)

Any person or business that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. (California Civil Code s. 1798.29(e) [agency] and California Civ. Code s. 1798.82(f) [person or business].)

Yeah. Sure. Happy to do that. I just — related to that, I just wanted to start off for any customers that might be listening on the call, because I know they do and they also listen to the ones recorded. And I’ve been talking to a lot of customers, I’d like to just apologize on behalf of Blackbaud for the incident. Over the last five years, we’ve made significant investments to build a modern cyber security practice significant. And we follow industry best practices, we conduct ongoing risk assessments and simulations, we aggressively test security of our solutions and our infrastructure, including with several third-party experts that come in, which is the best practice.

And during the quarter, we discovered and stopped sophisticated attempted ransomware attack. Like a lot of companies, we get millions of intrusion attempts a month and unfortunately one got in to a subset of our customers and a subset of our backup environment. And based on the nature of the incident in our research including with several third-party experts in investigation folks including law enforcement that we work with, we have no reason to believe that any data went beyond the cyber criminal or will be disseminated or made available publicly.

So the incident did not reach a majority of our hosted environments and it did impact a subset of our customers who were quickly notified a couple of weeks ago. The goal of the, of any cyber criminal is to get control of a company’s production environment, and we were able to detect and eradicate and stop that, so that never happens. So, it’s unfortunate, but we did not have a service disruption because of this, and we’re working with all of our customers that were involved here to help them through this. So my level of confidence here related to this one particular area is, we did remediate this area, we tested it, we had outside firms test it, and we’re pretty confident that this one area has been shored up if you will.

It’s unfortunate that this happened, because this obviously wasn’t discovered by us or the outside firms we work with over the last several years. And I think we’re in a good spot related to the amount of investment, the expertise we have, the folks we’ve hired from outside of the company that have significant backgrounds in the space, and the outside companies that we work with are tops in their fields. So it’s a big focus of ours and it’s unfortunate to happen, but we remain quite diligent in driving this part of the business forward.