Blackbaud is a cloud computing provider that serves the social good community — nonprofits, foundations, corporations, education institutions, healthcare organizations, religious organizations, and individual change agents. Its products focus on fundraising, website management, CRM, analytics, financial management, ticketing, and education administration.
Last week, the company disclosed that it was a victim of a ransomware attack in May 2020. Despite the company has discovered the intrusion and locked out the attackers, ransomware operators were able to exfiltrate its data.
“In May of 2020, we discovered and stopped a ransomware attack.” reads the data breach notification published by Blackbaud.
“Our Cyber Security team—together with independent forensics experts and law enforcement—successfully prevented the cybercriminal from blocking our system access and fully encrypting files; and ultimately expelled them from our system. Prior to our locking the cybercriminal out, the cybercriminal removed a copy of a subset of data from our self-hosted environment.”
The company confirmed that the attackers did not access financial data, such as credit card data and bank account information, or the social security numbers of its customers.
The bad news is that the company opted to pay the ransom for deleting the data that attackers have stolen during the intrusion.
The company reported the incident to law enforcement, and notified the customers who were affected by the incident. At the time Blackbaud did not disclose technical information about the attack such as the ransomware family that infected its systems.
It explained that it has no reason to believe that any data that was exfiltrated was or will be misused or disseminated.
The company pointed out that the incident did not involve solutions in its public cloud environment, such as Microsoft Azure or Amazon Web Services, nor did it involve the majority of its self-hosted environment.
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, ransomware)
[adrotate banner=”5″]
[adrotate banner=”13″]
U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.…
The U.S. Department of Justice (DoJ) announced the arrest of two co-founders of a cryptocurrency mixer…
Google addressed a critical Chrome vulnerability, tracked as CVE-2024-4058, that resides in the ANGLE graphics…
Nation-state actor UAT4356 has been exploiting two zero-days in ASA and FTD firewalls since November…
A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute…
The Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned four Iranian nationals for their…
This website uses cookies.