Blackbaud paid the ransom for a promise
A software provider to charities and universities paid attackers to delete stolen data. Its customers are now notifying donors.
Blackbaud, which provides software to charities, universities and hospitals, said last month that it paid a ransom after an attack in May, in exchange for confirmation that stolen data was destroyed. Many of its customers are now writing to their donors and alumni.
Paying for deletion means trusting the word of the people who stole the data. There’s no way to check.
If you’re a Blackbaud customer: check exactly what data was in the affected systems, and follow your data protection obligations about telling people.
For everyone who uses a provider for donor, student or customer data:
- Know what you’ve uploaded, and remove what you don’t need.
- Ask how the provider protects and encrypts it, and how fast they’ll tell you about an incident.
- Read the contract on breach notification and responsibility.