A year ago, on February 7, 2020, hackers managed to break into systems and steal millions of data from servers . Blackbaud is an American multinational company – a global leader in cloud computing. The Blackbaud hack has affected many organizations around the world, including foundations and hospitals. The victims also include universities, colleges and K-12 schools. Thus, it is worth mentioning in detail the type and volume of damage suffered by these educational facilities. The analysis is based on data collected over the last 6 months. The numbers that capture the impact of the massive hack are as follows:
- 419 is the (partial) number of universities/colleges/K-12 schools affected by the Blackbaud data breach
- 7,674,140 is the number of people affected
- 172 are the entities for which the exact number of people involved can be given
- 87 are the entities for which a partial number of individuals involved can be given
- 160 are the entities for which no number can be given regarding the individuals involved
Before analyzing the impact of the hack, a search was conducted on the various institutional websites of U.S., universities, colleges, and K-12 schools. In addition, some data has been provided by institutions in the United Kingdom and Ireland.
But let's take a detailed look at the history of the hack that hit Blackbaud and other organizations later:
- As we previously reported, on February 7 , 2020, hackers broke into the company's systems.
- On May 20, 2020, after more than three months during which hackers were able to operate “unhindered,” Blackbaud IT staff finally detected unauthorized access to their IT facilities.
- On July 16, 2020, Blackbaud published its first press release on its website. In the first statement, which came more than two months after the data theft was discovered, the multinational assured its customers that no type of personally identifiable information (PII) was affected by the data breach.
- After four days, at a forum of a US non-profit association of IT professionals in higher education, the first strong criticisms of Blackbaud's work were noted, regarding the majority of the time spent on reporting the data breach, but also the minimal information it provided to those directly involved. Dozens of US universities and colleges participated in the open discussion on the forum.
- The discussion then continued privately, outside the public forum.
- On September 29, 2020, Blackbaud released a second statement, denying that the data theft from the subset affected PII data, including bank account information, social security numbers, usernames, and/or passwords.
However, after investigating the hack, it was found that medical information, passport numbers, driver's license numbers, and tax identification numbers (TINs) were also affected at multiple universities, colleges, and K-12 schools. The investigation also revealed that Blackbaud, for some of the affected entities, had kept old backups on its servers.
The Catholic High School in San Diego, California, said that the American multinational's servers contained several backups of unencrypted PII data dating back 15 years. At Shady Hill School in Cambridge, Massachusetts (where 823 students were affected), the unencrypted data, including PII, was stored in a database dating back to 2012 and was linked to outdated versions of the Blackbaud software "Raiser's Edge" and "Financial Edge" used by the school.
For other institutions, such as St. Francis High School in Sacramento, California, Delft University of Technology (where 60,000 people are affected) , and Utrecht University in the Netherlands (where 6,000 people are affected), backups date back to 2017.
In many other cases, institutions were unaware of the existence of databases containing unencrypted sensitive information about their staff and students that Blackbaud maintained on its servers. One such case is that of Westminster School in Simsbury, Connecticut, where the PII data of 802 individuals was stored on the American multinational's servers without the school's knowledge.
Another institution that was unaware of the existence of an unencrypted database containing PII about its staff and students is Avon Old Farms School, also in Connecticut. In this case, the number of individuals involved is 2,804.
Maintaining highly sensitive unencrypted data in "outdated" databases, maintaining unprotected data without the knowledge of those directly involved, is the exact opposite of proper business management.
In addition, we can document Blackbaud’s mismanagement of how and when to send notifications to institutions affected by the data breach. A delay that forced universities, colleges, and K-12 schools to provide notifications to staff, students, and Attorneys General, in many cases only during these last few weeks.
Bishop Moore Catholic High School Orlando, Florida (5,981 people affected)
- notifications sent on 01/29/2021 (Maine residents)
Landon School Bethesda, Maryland (4,612 people involved):
- notifications sent on 01/22/2021 (residents of the states of Massachusetts, Maine, Vermont, New Hampshire)
The Archer School for Girls Los Angeles, California (6,385 participants)
- notifications sent on 13.01.2021 (residents of the states of Maine, Indiana, New Hampshire, Vermont)
After a year, we still don’t know the total number of entities affected by the hack, nor the total number of people whose sensitive data was compromised. After paying the ransom demanded by the hackers, Blackbaud was reluctant to reveal the true impact the security incident had on its customers, and it’s still not known which ransomware is behind the attack.
As for the number of people affected, it is currently around 20 million. Let's not forget those affected in hospitals , which are approaching 11 million, as Dissent (@PogoWasRight) of DataBreaches.net reported on suspectfile, and the institutions for which there is still no reliable data.
Some of the countries where the affected entities (universities, colleges, schools, K-12 and other organizations) are based are the US, Canada, New Zealand, the UK, Ireland, the Netherlands and Hungary.
Source: suspectfile.com
