Blackbaud Ransomware Victim Count Climbing

guest · Sep 10, 2020

Blackbaud Ransomware Victim Count Climbing
September 9, 2020
https://www.databreachtoday.com/blackbaud-ransomware-victim-count-climbing-a-14972

The May ransomware attack on cloud-based fundraising database management vendor Blackbaud continues to rack up victims in the healthcare sector.

A snapshot Wednesday of the federal health data breach tally shows at least eight organizations - including seven in recent weeks - reporting breaches linked the Blackbaud incident, affecting a combined total of nearly 1.6 million individuals so far - with additional relevant breaches yet to be posted.
The Blackbaud ransomware incident also has affected organizations in other industries.

The largest of the Blackbaud-related health data breaches was reported in August by Maine-based healthcare delivery system Northern Light Health, which said 657,000 individuals were affected.
Click to expand...

Over the last month, at least seven additional breaches tied to the Blackbaud ransomware attack have been posted on the tally, which lists health data breaches affecting 500 or more individuals.

One of those entities - Washington-based MultiCare Health System - reported to HHS a breach involving the Blackbaud ransomware attack affecting about 179,000 individuals.
Click to expand...

At least two more health data breaches - reported by North Carolina-based Atrium Health and Illinois-based NorthShore University HealthSystem have not yet made it to the federal tally. The Chicago Tribune reports that the NorthShore breach affected 348,000 individuals.
Vendor Attacks
The Blackbaud ransomware attack is the second major hacking incident in 2020 involving a vendor that has been responsible for large victim counts in the healthcare sector.
Click to expand...

guest · Sep 12, 2020

Inova Suffers Third-Party Data Breach
The breach occurred as part of a ransomware attack against service provider Blackbaud
September 9, 2020
https://www.darkreading.com/attacks-breaches/inova-suffers-third-party-data-breach/d/d-id/1338872

Inova Health Systems has notified customers that it was hit by a ransomware attack through a third-party vendor. Blackbaud, a vendor that provides fundraising support to nonprofit organizations, was itself hit by an attack that resulted in Inova data being exfiltrated from the Blackbaud servers.

According to Blackbaud, data was exfiltrated between February 7, 2020, and May 20, 2020. The exfiltration was part of a ransomware attack that did not succeed in encrypting significant data at Blackbaud.
The exfiltrated data included personally identifiable information on patients and donors to Inova, though it did not include Social Security numbers or payment information.
Blackbaud says that it has remediated the vulnerability that allowed the attack, and that its data is now safe.
Click to expand...

For more, read here.
Click to expand...

guest · Sep 13, 2020

Roper St. Francis sends data security breach warning to almost 93K patients
September 8, 2020
https://www.live5news.com/2020/09/0...ta-security-breach-warning-almost-k-patients/

Roper St. Francis Healthcare notified almost 93,000 patients of a data security breach involving Blackbaud that may have given hackers access to some personal data.

Blackbaud alerted RSFH of the breach on July 31, stating an unauthorized party gained access to Blackbaud’s systems between Feb. 7 and May 20. A release from Roper St. Francis Healthcare states Blackbaud said the party may have acquired “a backup copy of the database that manages fundraising information.”

“This incident did not affect all RSFH patient information; rather it was limited to Roper St. Francis Foundations' fundraising database and did not involve any access to medical systems or electronic health records,” Roper spokesman Andy Lyons said.
The fundraising database accessed by the unauthorized party may have included patients' names, ages, genders, dates of birth, addresses, dates of treatment, departments of service and treating physicians, he said.
Click to expand...

guest · Sep 13, 2020

Security breach leads to loss of Enloe patient information
September 11, 2020
https://krcrtv.com/news/local/security-breach-at-enloe-medical-results-in-patient-information-theft

On July 16, 2020, Enloe Medical Center was notified of a cybersecurity breach that resulted in the loss of their patients' private information.

Enloe released a press statement explaining that a third-party vendor, Blackbaud, Inc., was responsible for a breach in their cloud-computing service. Immediately after receiving notice of the initial breach, Enloe launched an investigation to better understand the scale of the security threat and also reported the incident to local law enforcement.
Blackbaud was able to uncover the breach that had infiltrated its systems and removed it on May 20, 2020.
Click to expand...

Enloe wants to reassure its patients that Social Security numbers, credit card numbers, and bank account information was not stolen during this event. Approximately 15% of the patients seen at Enloe over the past 18 months have been affected by this security breach.
Click to expand...

guest · Sep 17, 2020

Health care patient, donor data may have been breached
September 17, 2020
https://apnews.com/cc6b2ab75f2c0413dc56f27e20356ef8

Patients and donors to at least four different health care providers in Minnesota are being notified that their personal information may have been compromised.

The potential data breach involves hundreds of thousands of patients and donors at Children’s Minnesota, Allina Health, Regions Hospital and Gillette Children’s Specialty Healthcare.
The hack is part of a ransomware attack on a cloud computing company called Blackbaud, which manages databases for a number of nonprofits.

“Since learning of this incident, we have been working with Blackbaud to understand the scope of the ransomware attack and the steps it is taking to prevent future data security incidents,” a statement from Allina Health said. “
Click to expand...

More than 200,000 patients and donors from Allina Health hospitals and clinics and more than 160,000 patients and donors at Children’s Minnesota have been notified of the possible data breach.
Children’s Minnesota has told those involved to check their medical bills for signs of fraud.
[...] the Star Tribune reported.
Click to expand...

guest · Sep 17, 2020

Our Lady of the Lake Notifies Patients of Blackbaud Cyber Attack
September 15, 2020
https://ololrmc.com/news/our-lady-of-the-lake-notifies-patients-of-blackbaud-cyber-attack

Blackbaud was recently the victim of a ransomware attack, which may have affected certain Our Lady of the Lake Foundation data hosted by them. Our Lady of the Lake shares limited information with Our Lady of the Lake Foundation.

Blackbaud is one of the world’s largest cloud software tools and data management companies, used widely by thousands of health care institutions, not-for-profit organizations, and universities.
What Information Was Involved
The incident does not involve highly sensitive personal, financial, or diagnostic information. However, our research into this incident revealed that some demographic information (such as names, addresses, phone numbers and e-mail addresses) was included. In addition, limited health information such as dates of birth, physician names, and visit location may have been included.
Click to expand...

What Our Lady of the Lake is Doing
Our Lady of the Lake immediately launched its own review and have taken the following steps:

Working with Blackbaud to understand why there was a delay between finding the breach andnotifying us, as well as what actions Blackbaud has and is taking to increase its security andprevent future attacks; [...]

Click to expand...

The Daily Swig: Ransomware attack on third-party software continues to claim victims

Separately, Our Lady of the Lake Regional Medical Center in Baton Rouge, Louisiana, also announced this week it had been subject to a breach via the Blackbaud attack.
The medical center’s sister organization, Our Lady of the Lake Foundation, was one of the victims of the Blackbaud breach in May.
Hundreds of organizations impacted
So far, the Blackbaud incident has affected hundreds of organizations from healthcare providers to universities and other charities.

Last month, two UK charities announced they had been impacted by the breach. The Christie and the Mines Advisory Group, both based in Manchester, both fell victim to the attack.
Click to expand...

Third-party risk
The scale of the Blackbaud breach also raises more questions regarding the use of third-party software.

Jeremy Hendy, CEO at digital risk protection company Skurio, told The Daily Swig: “Breaches often happen through a security failure at a supply chain partner, three or four levels removed from your own organization.

“Healthcare organizations have complex digital ecosystems, with sensitive patient and staff data potentially flowing through thousands of different technologies – many of which may not be visible.
Click to expand...

guest · Sep 21, 2020

St. Francis Medical Center
Blackbaud Security Incident
https://www.stfrancismedical.org/about-us/foundation/blackbaud-security-incident

St. Francis Medical Center was recently notified by Blackbaud, a third-party service provider in the fundraising industry, that their company was the target of a recent cyber-attack, which has been reported to have affected more than 25,000 educational institutions and charities across the world, including St. Francis Medical Center. You can learn more about the Blackbaud security incident here.

In addition to the investigation by Blackbaud, St. Francis Medical Center and Trinity Health, our parent company, are conducting our own investigation of the situation. We are working diligently to understand the impact of this matter on our donors and patients, and are communicating with individuals whose information was affected.
Click to expand...

[...]
The nature of this attack was large and complex, and our investigation will be concluded by the end of September. We will begin individual notifications on September 14, 2020. Due to the large volume of notifications, the notifications will continue to be mailed out until all impacted patients, donors and individuals are notified.
Click to expand...

guest · Sep 22, 2020

Officials: Data possibly compromised at two Long Island hospitals
September 21, 2020
https://www.newsday.com/long-island/suffolk/stony-brook-university-hospital-1.49516418

Patient information from at least two Long Island hospitals was potentially compromised in a May ransomware attack on a third-party software provider, officials said Sunday.
Blackbaud, a fundraising technology provider for nonprofits said on its website that a cybercriminal accessed data from its system during the attack.

Stony Brook University Hospital and Mount Sinai South Nassau Hospital in Oceanside, which both use the platform, said they received notice of the ransomware attacks on July 17 and 16 respectively.
Click to expand...

Stony Brook University Hospital said 175,000 patients were potentially affected. A spokeswoman said the hospital identified those whose data may have been affected.

"Based on statements from Blackbaud, Stony Brook has no reason to believe that the information involved in this incident has been misused," said Erin Stoeber, Stony Brook Medicine's assistant vice president, marketing and communications, in a statement.
Mount Sinai South Nassau Hospital, in a message posted to its website Wednesday, said it immediately started an investigation and on Aug. 28 found the affected data "may have contained personal information."
Click to expand...

guest · Sep 23, 2020

Tennessee healthcare data breach impacts 235,000 patients
Blackbaud cyber-attack claims another victim
September 23, 2020
https://portswigger.net/daily-swig/tennessee-healthcare-data-breach-impacts-235-000-patients

The University of Tennessee Medical Center has announced a data breach impacting a reported 235,000 people.
The breach was a result of the Blackbaud cyber-attack in May 2020, which exposed the personal data of thousands of individuals around the world.
Healthcare breach
The University of Tennessee Medical Center discovered its customers had been a victim of the Blackbaud breach on July 16.
Patient names, contact details, and demographic data may have been accessed as a result of the incident, the medical center said.

A statement reads: “Blackbaud has specifically informed us that the cybercriminal did NOT access credit card information, bank account information, or social security numbers.
Click to expand...

guest · Sep 24, 2020

Victims of Blackbaud ransomware attack to take legal action
September 24, 2020
https://www.itgovernance.co.uk/blog/victims-of-blackbaud-ransomware-attack-to-take-legal-action

Students and staff at the University of Cumbria who were affected by the ransomware attack on Blackbaud are preparing to take legal action against the software provider.

Blackbaud, which provides education administration, fundraising and financial management support, was attacked earlier this year, with cyber criminals accessing victims’: [...]
The University of Cumbria was one of more than 125 UK-based organisations affected by the attack.
Click to expand...

Robert Godfrey, the head of professional negligence at Simpson Millar, was confident that anyone affected by the data breach had a valid claim for damages against the University of Cumbria and the distress caused.

He said: “We have had members of the universities contact us who are quite rightly very concerned. We are actively investigating potential claims on behalf of people directly affected by this serious breach. This is a clear violation of GDPR [General Data Protection Regulation] and data protection rules.
The one caveat to this is that it only applies to data breaches where the organisation breached data protection law. Simpson Millar must therefore demonstrate that Blackbaud failed to meet its GDPR compliance requirements.
Click to expand...

What about other universities?
The situation at the University of Cumbria isn’t unique; it’s one of more than twenty UK universities affected by the Blackbaud attack, so we may well see victims who are affiliated with other institutions joining the students and staff at the University of Cumbria in legal action.
If so, it could be a major wake-up call that the education sector needs to do a better job addressing cyber security.
Click to expand...

guest · Sep 24, 2020

Blackbaud Ransomware Breach Victims, Lawsuits Pile Up
More Entities Reporting Breaches Tied to Attack; Millions Affected
September 24, 2020
https://www.databreachtoday.com/blackbaud-ransomware-breach-victims-lawsuits-pile-up-a-15053

As the tally of reported heath data breaches related to the May ransomware attack on Blackbaud continues to climb, so do the number of lawsuits filed against the cloud-based fundraising software vendor.

As of Thursday, more than three dozen Blackbaud-related health data breaches affecting about 5 million individuals had been posted to the Department of Health and Human Services' HIPAA Breach Reporting Tool website since the company began notifying clients in the healthcare sector and other affected industries - including universities and nonprofit organizations - about the ransomware incident the company discovered in May.
Commonly called the "wall of shame", the HHS Office for Civil Rights website lists health data breaches impacting 500 or more individuals.
Click to expand...

Meanwhile, at least 10 lawsuits seeking class-action status have been filed against Charleston, S.C.-based Blackbaud.
"As a result of the data breach, plaintiffs and thousands of other class member users suffered ascertainable losses in the form of out-of-pocket expenses and the value of their time reasonably incurred to remedy or mitigate the effects of the attack," alleges the complaint filed by plaintiffs Mamie Estes and Shawn Regan.

But the lawsuit claims the company "cannot reasonably maintain that the data thieves destroyed the subset copy simply because the defendant paid the ransom and the data thieves confirmed the copy was destroyed."
Click to expand...

Long List of Victims
Besides healthcare sector entities, others affected by the Blackbaud incident include Valley City State University, the University of North Dakota, North Dakota State University, Minot State University, the University of Bridgeport, the West Virginia University Foundation and Emerson College.

Also affected were nonprofit organizations, including National Public Radio stations, the Vermont Food Bank and the Episcopal Relief & Development organization, as well as a number of institutions outside the U.S., including Canada's University of Western Ontario and New Zealand's University of Auckland (see Blackbaud's Bizarre Ransomware Attack Notification).
Click to expand...

guest · Sep 30, 2020

Blackbaud: Ransomware gang had access to banking info and passwords
September 30, 2020
https://www.bleepingcomputer.com/ne...ang-had-access-to-banking-info-and-passwords/

Blackbaud, a leading cloud software provider, confirmed that the threat actors behind the May 2020 ransomware attack had access to unencrypted banking and login information, as well as social security numbers.

The security incident Blackbaud refers to was disclosed in a press release issued on July 16, 2020, when the company said that the attackers were blocked before fully encrypting systems but not before they were able to steal a "copy of a subset of data" from a self-hosted (private cloud) environment.
Subsequently, the cloud provider paid the ransom after receiving confirmation from the attackers that the stolen data was destroyed.

The list of organizations directly affected by the ransomware attack on Blackbaud includes a long list of entities including charities, non-profits, foundations, and universities from the United States, Canada, the United Kingdom, and the Netherlands.
Click to expand...

Banking info and credentials exposed in the attack
While Blackbaud initially said that the ransomware gang behind the attack was not able to "access credit card information, bank account information, or social security numbers," it later discovered after a forensic investigation that the threat actors had access to unencrypted banking info, credentials, and SSNs.

Blackbaud also said that the forensic investigation regarding the May ransomware attacks is still ongoing and that the company will continue to keep customers, stockholders, and other stakeholders informed of any new developments.
Click to expand...

Depending on the ransomware gang who stole Blackbaud's data, its willingness to actually destroy it, and what it intends to do with it if it wasn't actually destroyed as promised, the company's customers may be facing a wide range of security risks given the extremely sensitive nature of the exposed information.
Click to expand...

guest · Oct 5, 2020

Sisters of Charity Health System Notifies Patients of Blackbaud Data Security Incident
Notice to Our Patients of Blackbaud Data Security Incident
https://www.sistersofcharityhealth....patients-of-blackbaud-data-security-incident/

The Sisters of Charity Health System (“SCHS”) is committed to protecting the security and privacy of our community members. Regrettably, we recently learned of an incident that occurred at one of our vendors, Blackbaud, Inc. (“Blackbaud”), that involved some SCHS information.

Based on our review of the database involved in the incident, it may have contained some patient information, including names, contact information, gender, dates of birth, dates and locations of service, service lines, and treating physicians. The database may have also contained information about relationships with SCHS entities such as donation history, volunteer service and employment, if any.
Social Security numbers, credit card and financial account information contained in the database were encrypted, and therefore were not accessible.
Click to expand...

We want our patients to know that we are taking this matter very seriously. We mailed letters regarding the incident to those whose information was contained in the Blackbaud database beginning October 1, 2020.
Click to expand...

guest · Oct 8, 2020

Blackbaud mum on which universities had Social Security data stolen
October 6, 2020
https://edscoop.com/blackbaud-social-security-information-cyberattack/

The cloud-based service provider Blackbaud last week updated its story about a cyberattack affecting its servers earlier this year, noting that hackers had gained access to unencrypted banking information and Social Security numbers for some of its customers.

In an email to EdScoop, a company spokesperson said Blackbaud is not publicly disclosing the identities of the affected organizations, and has instead chosen to notify them each privately.

“To respect the privacy of our customers, we cannot provide the names of those who were part of this incident nor can we discuss any customer specifically,” the spokesperson wrote.
The company also said “the majority” of its customers were not affected by the incident, though dozens of organizations — including universities, nonprofits and hospitals — have announced that their customers’ data was exposed by the cyberattack in some way.
Click to expand...

(Bloomberg Law reported Tuesday that two patients of New York hospitals have filed lawsuits against Blackbaud, claiming the company violated state consumer protection laws and did not comply with data-protection standards.)
Blackbaud wrote in a Sep. 29 blog post that hackers removed data from the company’s private cloud environment.

Some of the affected universities are known, but it’s unclear which, if any, saw their financial or Social Security data exposed.
Blackbaud customers also include organizations as wide-ranging as the Sacramento Zoo, the Catholic Diocese of Trenton and the University of London.
Click to expand...

guest · Oct 21, 2020

...Over 300K more patients added to Blackbaud Breach Tally
October 20, 2020
https://healthitsecurity.com/news/ransomware-attack-hits-dickinson-county-health-spurs-ehr-downtime

[...] At least four more providers and over 300,000 patients have been added to the Blackbaud breach victim tally that’s already claimed well over 6 million victims. Blackbaud is a cloud computing vendor for a range of nonprofits, foundations, healthcare entities, corporations, and other change agents.

First reported in mid-August, Blackbaud discovered a ransomware attack on its self-hosted environment on May 20. However, the attack began several months earlier on February 7. While inside the network, the hackers exfiltrated data from some Blackbaud clients, including donors, patients, and other individuals with relationships to those entities.
Click to expand...

According to the Department of Health and Human Services, the breach has now claimed four additional clients: Geisinger (86,412), Lawrence + Memorial Hospital (21,617), Presbyterian Health Services (193,223), and Sisters of Charity of St. Augustine Health System (118,874).
Click to expand...

guest · Oct 23, 2020

OSF HealthCare Addresses Blackbaud Data Security Incident
October 20, 2020
https://newsroom.osfhealthcare.org/osf-healthcare-addresses-blackbaud-data-security-incident/

OSF HealthCare System (“OSF”) is mailing letters to its patients advising them of a data security incident that occurred at one of its vendors, Blackbaud, Inc. (“Blackbaud”). Blackbaud provides cloud-based and data solution services related to OSF’s fundraising activities.

Blackbaud notified its customers it discovered that an unauthorized individual gained access to Blackbaud’s systems between February 7 and May 20, 2020. Blackbaud advised that the unauthorized individual may have acquired backup copies of databases used by its customers, including a backup of the database OSF uses for fundraising efforts. After being notified, OSF immediately took steps to understand the extent of the incident and the data involved.
Click to expand...

OSF HealthCare takes patients’ privacy very seriously. To help prevent something like this from happening again, OSF is assessing the security safeguards at Blackbaud and evaluating the data elements stored on the Blackbaud systems
Click to expand...

guest · Oct 29, 2020

Cloud Service Provider ‘Blackbaud’ Leaks Breast Cancer Data
‘Living Beyond Breast Cancer’ is sending notices of a data breach to its members
October 29, 2020
https://www.technadu.com/cloud-service-provider-blackbaud-leaks-breast-cancer-data/220957/

The American nonprofit organization ‘Living Beyond Breast Cancer’ (LBBC) is sending notices of a data breach to its members to alert them of a possible compromise of their sensitive data. According to the letters that have been published by the data protection authorities, the breach happened on Blackbaud’s systems, which apparently suffered a ransomware attack. Blackbaud is a cloud services provider that covers the needs of schools, hospitals, and many nonprofit organizations like LBBC.

While the typical assurances of having no reason to believe that the data has been misused or further disseminated are included in the notice, this is unlikely to be the case. Thus, if you have participated in an LBBC program in the past and shared your personal details with the organization, consider yourself compromised.
Click to expand...

This means that crooks could now launch scamming, phishing, and social engineering attacks against you. Do keep that in mind and treat all incoming communications with extra caution. I
Click to expand...

guest · Nov 3, 2020

Blackbaud sued in 23 class action lawsuits after ransomware attack
November 3, 2020
https://www.bleepingcomputer.com/ne...lass-action-lawsuits-after-ransomware-attack/

Leading cloud software provider Blackbaud has been sued in 23 proposed consumer class action cases in the U.S. and Canada related to the ransomware attack that the company suffered in May 2020.

The organizations impacted by the ransomware attack on Blackbaud include a long list of entities such as charities, non-profits, foundations, and universities from the U.S., Canada, the U.K., and the Netherlands.
Lawsuits and data regulator inquiries
Blackbaud today confirmed that it has been named as a defendant in 23 putative class suits linked to the May ransomware attack in its 2020 Q3 Quarterly report filed with the U.S. Securities and Exchange Commission (SEC).

"To date, we have been named as a defendant in 23 putative consumer class action cases (17 in U.S. federal courts, 4 in U.S. state courts and 2 in Canadian courts) alleging harm from the Security Incident," Blackbaud said.
The cloud software provider has also received roughly 160 claims related to the ransomware attack from customers and/or their attorneys in the U.S., U.K., and Canada.
Click to expand...

"We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations," Blackbaud added.
Expenses, exposed data, and security risks
Blackbaud had to spend over $3 million to deal with the attack's aftermath between July and September, and it also recorded almost $3 million in accrued insurance recoveries during the same time period.

"In the three months ended September 30, 2020, we recorded $3.2 million of expenses and $2.9 million of accrued insurance recoveries related to the Security Incident, and in the nine months ended September 30, 2020, we recorded $3.6 million of expenses and $2.9 million of accrued insurance recoveries related to the Security Incident," the company said.
Click to expand...

guest · Nov 3, 2020

Blackbaud Expects Cyber Insurer Will Cover Most Attack Costs
November 3, 2020
https://www.databreachtoday.com/blackbaud-expects-cyber-insurer-will-cover-most-attack-costs-a-15298

As the list of customers reporting data breaches tied to the May ransomware attack on Blackbaud continues to surge, and related legal actions against the company grow, the cloud-based fundraising software vendor recently told Wall Street that it expects cyber insurance to cover the bulk of its costs associated with the incident.

During an Oct. 30 call with financial analysts to discuss the Charleston, S.C.-based vendor's third quarter earnings, Blackbaud executives also said the company has fixed a weakness in one of its older products linked to the cyber incident.

"Through our forensics investigation, we were able to understand exactly how this [cyberattack] occurred and we've remediated the vulnerability, which was tied to one of our early generation products," Michael Gianoni, Blackbaud president and CEO told analysts, according to a transcript of the call.
Click to expand...

Growing List of Victims
Blackbaud did not immediately respond to Information Security Media Group's request for details regarding the "early generation product" that contained the security vulnerability leading to the incident.
Blackbaud also declined ISMG's request for information regarding its customers, including those in the healthcare sector, impacted by the incident.

But in the recent earnings call with financial analysts, Blackbaud executives appeared confident that the company's insurers would cover most of the costs associated with the incident.

"We have good insurance in place - our insurers are working with us very closely. The key there is coordinating with them and make sure we're clear on what they're covering or not going to cover," Anthony Boor, Blackbaud chief financial officer, told the analysts.
Click to expand...

guest · Nov 4, 2020

OAIC confirms inquiries made with cloud software firm that was breached
November 4, 2020
https://www.itwire.com/security/oai...th-cloud-software-firm-that-was-breached.html

The Office of the Australian Information Commissioner has confirmed that it has made inquiries with Blackbaud, an American cloud software firm that was hit by ransomware and ended up paying a ransom to get its data decrypted.

But an OAIC spokesperson did not go into any detail about what inquiries were made and when the organisation expected to hear back from Blackbaud.

"We can confirm we have made inquiries with Blackbaud and those inquiries are continuing," the spokesperson said in response to an inquiry.
Click to expand...

Blackbaud initially said the attackers had no access to customer data in July when it said it had paid the ransom, but then did a backflip in October, saying that customer data has indeed been accessed.
The company reported revenue of US$900,423 (A$1.28 billion) in 2019.
Click to expand...

guest · Nov 4, 2020

Chesapeake Regional Healthcare data breach exposes 23,000 individuals’ sensitive information
Widespread attack on Blackbaud fundraising software claims yet more victims
November 4, 2020
https://portswigger.net/daily-swig/...oses-23-000-individuals-sensitive-information

A data breach at Chesapeake Regional Healthcare in Virginia, US, has potentially exposed more than 23,000 individuals’ sensitive information.

The organization, which operates the Chesapeake Regional Medical Center, Outer Banks Hospital, and numerous ancillary healthcare facilities, this week revealed that the personal data of 23,058 patients, donors, and employees may have been accessed as a result of a third-party breach.
Those affected by the incident have been notified by first class mail and email, Chesapeake Regional Healthcare said in a statement.

“Because the cybercriminal did not access credit card information, bank account information, social security numbers, and other personal identification information, the data breach presents a low risk for identity theft,” the statement added.
Click to expand...

Multiple organization failure
The incident occurred due to a security incident affecting donor and fundraising software vendor Blackbaud.

“Blackbaud has assured Chesapeake Regional that they have implemented several changes to protect data from any subsequent incidents,” Chesapeake Regional Healthcare said.
Click to expand...

guest · Dec 3, 2020

Manlius Pebble Hill school victim of nationwide ransomware attack
December 3, 2020
https://www.syracuse.com/schools/20...l-victim-of-nationwide-ransomware-attack.html

Manlius Pebble Hill school in DeWitt is among numerous organizations and businesses nationwide hit by the Blackbaud data security breach.

Blackbaud is a a cloud-based technology company used by colleges, universities, nonprofits and some health-care organizations. At least 6 million individuals were affected by the incident in May, according to media reports.
The private preK-to-12th grade school was notified in July it was among the victims, school officials said.
Click to expand...

MPH officials said the “hacker” may have been able to access files which included a backup file belonging to the school, said Adam Sayre, the school’s director of finance and operations. That file contained information on members of the MPH community.

Sayre stressed that no one has reported to MPH any issues or improper use from the data security incident.
MPH complied with the state reporting requirements and notified New York State Attorney General’s office.
Click to expand...

Blackbaud, cloud software provider, has been sued in 23 proposed consumer class action cases in the U.S. and Canada related to the ransomware attack and data breach, according to media reports.
Click to expand...

guest · Dec 4, 2020

AHN donors may have been exposed to data breach, officials say
December 4, 2020
https://triblive.com/local/ahn-donors-may-have-been-exposed-to-data-breach-officials-say/

Donors to Allegheny Health Network might have had their personal information exposed during a ransomware attack earlier this year on an IT company used by hundreds of hospitals, universities and other nonprofits, officials said Friday.

Blackbaud, a global tech company, provides cloud computing services to a slew of institutions including AHN, which uses the company to maintain its fundraising records and database of donors.
Click to expand...

Health network representatives in the process of contacting donors who might be affected, according to a statement.

“AHN is continuing to closely monitor the situation alongside Blackbaud’s cyber security team, independent forensics experts, and law enforcement agencies, and it will keep its donors appropriately informed of any further developments,” the statement read.
In September, Phipps Conservatory announced to past and present members that it, too, was affected by the attack on Blackbaud.
Names, emails and addresses, however, might have been exposed, Phipps officials said.
Click to expand...

Other local organizations affected include The Frick, the University of Pittsburgh, Children’s Hospital of Pittsburgh and the Carnegie Museums of Pittsburgh, according to a list published in the San Antonio Business Times.
A number of international organizations were also affected by the data breach, according to a July list from the BBC, including the Boy Scouts of America and the American Civil Liberties Union.
Click to expand...

guest · Dec 24, 2020

Nebraska Methodist Health System details security breach involving vendor
December 19, 2020
https://www.3newsnow.com/news/local...stem-details-security-breach-involving-vendor

Nebraska Methodist Health System is notifying patients of a data breach involving one of its third-party vendors.

The breach involved Blackbaud, which provides customer relationship management and financial services tools for fundraising purposes to thousands of schools, health systems, and non-profits.
Blackbaud said the unauthorized individual may have acquired backup copies of customer databases, including the databases used by the Methodist Hospital Foundation and the Jennie Edmundson Foundation for fundraising efforts.
Click to expand...

Social Security numbers, financial account, and credit card account information were not part of the information stored in the Blackbaud database and were not involved in the incident. The incident also did not involve any access to the Nebraska Methodist network or systems.
Methodist mailed letters to patients whose information was contained in the Blackbaud database on December 14.
Click to expand...

guest · Jan 23, 2021

[paywalled]
Calif. Children's Hospital Sued Over Blackbaud Data Breach
January 22, 2021
https://www.law360.com/articles/1347415/calif-children-s-hospital-sued-over-blackbaud-data-breach

California's largest children's hospital is facing a putative class action in federal court claiming it failed to protect nearly 20,000 patients' private medical information, which was swept up in a ransomware attack on its software provider Blackbaud Inc. last year.

Plaintiff John Doe, a minor who brought the suit through his guardian Latasha Pope, claims that Rady Children's Hospital-San Diego failed to uphold its duty under California's Confidentiality of Medical Information Act when it allowed unauthorized hackers to obtain valuable medical data - including names, dates of birth and treatment information - belonging to approximately 19,788 patients.
The patient information was.. [...]
Click to expand...

Log in or Sign up

Blackbaud Ransomware Victim Count Climbing

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Blackbaud Ransomware Victim Count Climbing

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches