Blackbaud Data Security Incident

July 27, 2020

The Concord University Foundation was recently notified by Blackbaud, one of the Foundation's service providers, of a security incident. At this time, we understand Blackbaud discovered and stopped a ransomware attack. After discovering the attack, Blackbaud's Cyber Security team—together with independent forensics experts and law enforcement— successfully prevented the cybercriminal from blocking their system access and fully encrypting files; and ultimately expelled them from their system. According to Blackbaud, prior to locking the cybercriminal out, a copy of a backup file containing your personal information may have been removed. This occurred at some point beginning on February 7, 2020 and could have been in there intermittently until May 20, 2020.

What Information Was Involved

It’s important to note that the cybercriminal did not access your credit card information or bank account information. However, we have determined that the file removed may have contained your contact information, demographic information, and a history of your relationship with the Concord University Foundation, such as donation dates and amounts.

Because protecting customers’ data is Blackbaud's top priority, the company paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed. Based on the nature of the incident, their research, and third party (including law enforcement) investigation, we have no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly.

What We Are Doing　

We are notifying you so that you can take immediate action to protect yourself. Ensuring the safety of our constituents’ data is of the utmost importance to us. As part of its ongoing efforts to help prevent something like this from happening in the future, Blackbaud has already implemented several changes that will protect your data from any subsequent incidents.

First, Blackbaud's teams were able to quickly identify the vulnerability associated with this incident, including the tactics used by the cybercriminal, and took swift action to fix it. It has been confirmed through testing by multiple third parties, including the appropriate platform vendors, that the fix withstands all known attack tactics. Additionally, Blackbaud is accelerating efforts to further harden its environment through enhancements to access management, network segmentation, deployment of additional endpoint and network-based platforms.

What You Can Do　

As a best practice, we recommend you remain vigilant and promptly report any suspicious activity or suspected identity theft to us and to the proper law enforcement authorities.　

For More Information　

We sincerely apologize for this incident and regret any inconvenience it may cause you. Should you have any further questions or concerns regarding this matter and/or the protections available to you, please do not hesitate to contact the Concord University Foundation by calling 304-384-5119 or emailing foundation@concord.edu