Information about Blackbaud security incident

Augusta University was recently notified by Blackbaud, a software vendor for the Georgia Health Sciences Foundation, of a security incident that occurred in Blackbaud’s systems between February and May 2020.

Blackbaud is a leading software and service provider for numerous nonprofit organizations, foundations, institutes of higher education, and faith communities across the country and throughout the world. Current reports suggest many of Blackbaud’s customers in multiple countries were impacted by this incident.

Blackbaud reports the cybercriminal did not access credit card information, bank account information, or social security numbers.

According to Blackbaud, the cybercriminal did, however, remove a copy of a subset of Blackbaud customer data beginning as early as February 2020. This subset of data may have included contact information, demographic/donor profile information, patient experience information, and relationship/donation information.

Blackbaud reports that they paid the cybercriminal’s ransom demand and obtained confirmation that the copy the cybercriminal removed had been destroyed.

Blackbaud has also reported that based on the nature of the incident, their research and investigations by third parties including law enforcement, Blackbaud has no reason to believe that any data went beyond the cybercriminal. They also do not believe the information was misused or will be misused or made publicly available in the future.

What are we doing?

We take the protection and proper use of donor information very seriously. Foundation and university representatives are communicating with Blackbaud about the seriousness of this matter and Blackbaud’s handling of our data.

We are reviewing all relevant business practices regarding the security of Blackbaud data. In addition, numerous security changes have already been implemented by Blackbaud.

Blackbaud has stated that they confirmed through testing by multiple third parties that its new security protocol withstands all known attack tactics. Furthermore, Blackbaud stated they are increasing the security of its environment through enhancements to access management, network segmentation, deployment of additional endpoint and network-based platforms.

What can you do?

Blackbaud has informed us that they do not believe there is anything for individuals to do at this time aside from maintaining routine personal practices of remaining vigilant to cybercriminal scams, and promptly reporting any suspicious activity to law enforcement authorities.

For more information about this incident, you can consult the Blackbaud website at blackbaud.com/securityincident. If you have additional questions about this incident, please contact Georgia Health Sciences Foundation directly via email at privacy@augusta.edu.