Blackbaud Ransomware Victim Count Climbing

guest · Jan 28, 2021

mood said: ↑

[paywalled]
Calif. Children's Hospital Sued Over Blackbaud Data Breach January 22, 2021
Click to expand...

Rady Children’s Hospital Facing Class Action Lawsuit over Blackbaud Ransomware Attack
January 26, 2021
https://www.hipaajournal.com/rady-c...ion-lawsuit-over-blackbaud-ransomware-attack/

In May 2020, the cloud software company Blackbaud suffered a ransomware attack. As is common in human operated ransomware attacks, data was exfiltrated prior to file encryption. Some of the stolen data included the fundraising databases of its healthcare clients.

One of the affected healthcare providers was Rady Children’s Hospital-San Diego, the largest children’s hospital in California in terms of admissions. A class action lawsuit has been proposed that alleges Rady was negligent for failing to protect the sensitive information of 19,788 individuals which was obtained by the hackers through Blackbaud’s donor management software solution.
Click to expand...

The lawsuit alleges Rady cannot reasonably maintain that the hackers destroyed the plaintiffs’ personal information. According to the complaint,

“On information and belief, Blackbaud has not provided verification or further details regarding the disposition of the data to confirm that the stolen data has been destroyed.”
The lawsuit also alleges neither Rady nor Blackbaud are aware how the hackers exfiltrated data, and whether it was transmitted in a secure manner and could not have been intercepted by other individuals.

According to the lawsuit, Rady had the necessary resources to protect patient data but neglected to implement appropriate security. The plaintiffs seek compensation, long -term protection against identity theft and fraud, and a court order to enforce changes to Rady’s security policies to ensure breaches such as this, and several others cited in the report, do not happen again.
Click to expand...

guest · Jun 20, 2021

Alina Lodge notifies patients of data breach tied to 2020 Blackbaud incident
June 18, 2021
https://www.scmagazine.com/home/hea...-data-breach-tied-to-2020-blackbaud-incident/

The Blackbaud data breach was the largest health care-related incident of 2020, impacting an estimated two dozen providers and well over 10 million patients. Now, 2,565 patients of addiction treatment center Alina Lodge are being notified that their data was compromised during the massive vendor incident more than a year ago.

In February 2020, threat actors hacked into its self-hosted environment, stealing data as they proliferated across the network.
What’s worse, the hack was not discovered until three months later, when the attackers deployed ransomware onto its self-hosted environment on May 14, 2020. Blackbaud officials confirmed they paid the ransom demand “with confirmation that the copy they removed had been destroyed.”
Click to expand...

The vendor is currently facing at least two dozen lawsuits, in the wake of the event.

The Alina Lodge breach notice shows the provider was notified that its data was compromised by the Blackbaud incident more than six months ago in October 2020. However, Alina Lodge was told that its data was encrypted, and therefore not viewable by the threat actors.

On April 19, 2021, Blackbaud informed the Hardwick Township, N.J.-based Alina Lodge that its data had been exposed during the attack. As such, the attackers likely accessed personal data, such as names, contact details, admission and discharge dates, and other treatment details, like recovery status and diagnoses.
Click to expand...

guest · Oct 29, 2021

Customers Can Pursue Negligence Claims Directly Against Vendor
October 2, 2021 (Updated: October 29, 2021)
https://www.dataprotectionreport.co...ue-negligence-claims-directly-against-vendor/

On October 19, 2021, a federal trial court in South Carolina ruled that a group of consumers could proceed with common law negligence and gross negligence claims directly against their organizations’ vendor that had been the victim of a security breach—instead of suing the organizations of which they were customers.
In re Blackbaud, Inc. Customer Data Breach Litigation, Case No.: 3:20-mn-02972-JMC, MDL No. 2972 (D.S.C. Oct. 19, 2021). The court therefore denied the vendor’s motion to dismiss these counts in the plaintiff’s complaint, although it did grant the motion to dismiss for the plaintiff’s negligence per se and unjust enrichment claims.

Blackbaud also argued it had no duty to the plaintiffs against the unlawful conduct of a third-party criminal actor.
The court ruled that “Plaintiffs have alleged facts supporting the application of this exception to the general rule that there is no duty to protect another from the conduct of third parties.”
Click to expand...

Therefore, the court concluded, “Based upon the foregoing, the court finds Plaintiffs have alleged sufficient facts to support their assertion that Blackbaud owed them a duty based on the special circumstances of Blackbaud’s contracts with the Social Good Entities and Blackbaud’s alleged creation of the risk.”
Click to expand...

Takeaways
Although this case is at a very early (motion to dismiss) stage,

If consumers can directly sue parties with which they have no direct contact or even a contract, it may become even more difficult/expensive to obtain cyberinsurance because liability may become almost unlimited.

We note that the plaintiffs claimed that the negligence and gross negligence claims included Blackbaud’s alleged “storing obsolete data.” As we have previously written, over-retention of personal data can be expensive.

Click to expand...

Log in or Sign up

Blackbaud Ransomware Victim Count Climbing

guest Guest

guest Guest

guest Guest

Log in or Sign up

Blackbaud Ransomware Victim Count Climbing

guest Guest

guest Guest

guest Guest

Useful Searches