Blackbaud controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile14 entries
2024
FTC data-retention and security settlement
The FTC announced an order requiring Blackbaud to improve information-security controls, establish a data-retention policy, and delete personal information that is not needed for business or legal purposes.
2023
SEC cybersecurity disclosure enforcement
The SEC fined Blackbaud $3 million over alleged failures to accurately disclose the scope of sensitive customer information accessed in the 2020 cyberattack.
2023
Multistate data-breach settlement
Blackbaud agreed to a $49.5 million settlement with 49 states and the District of Columbia concerning the 2020 breach. The settlement imposed additional security, notification, training, encryption, and compliance obligations.
2021
Alina Lodge notifies patients of data exposure
Issue disclosure
Alina Lodge notified 2,565 patients that their data was compromised in the 2020 Blackbaud incident. The data may have included personal and treatment information. Patients were to receive free credit monitoring and identity protection services.
Company response
Remediation — Alina Lodge
Patients will receive free access to credit monitoring and identity protection services.
Source excerpt
Patients will receive free access to credit monitoring and identity protection services.
As such, the attackers likely accessed personal data, such as names, contact details, admission and discharge dates, and other treatment details, like recovery status and diagnoses.
On April 19, 2021, Blackbaud informed the Hardwick Township, N.J.-based Alina Lodge that its data had been exposed during the attack.
2021
Court allows claims against Blackbaud to proceed
Ruling
In litigation following a 2020 ransomware data breach, a federal judge refused to dismiss all claims against Blackbaud, including claims under the California Consumer Privacy Act and claims alleging deceptive and unfair trade practices; the judge dismissed several other state statutory claims.
Source excerpt
Blackbaud, which suffered a data breach of its customers’ data in a ransomware attack in 2020, in which it admitted paying the ransom in a double extortion attack, is facing multiple class action cases following the attack.
The federal judge overseeing the cases has refused to dismiss all of the claims that the plaintiffs alleged against Blackbaud, and ruled that Blackbaud must face claims of violation of the California Consumer Privacy Act (CCPA), deceptive and unfair trade practice allegations made by Florida and New York plaintiffs, and a separate claim by a California plaintiff alleging the compromise of medical information.
2020
Ransomware attack and customer-data exposure
A ransomware attack resulted in unauthorized access to customer data affecting more than 13,000 customers, including universities and charities in several countries. Blackbaud paid a ransom after receiving purported confirmation of deletion, but did not independently verify that the stolen information had been destroyed. The company was criticized over disclosure timing and later acknowledged that more sensitive information had been accessed than initially indicated.
2020
UMass Memorial notifies patients of Blackbaud data breach
Issue disclosure
UMass Memorial announced that a security breach at its vendor Blackbaud may have involved a backup of the hospital's donor and fundraising database. The hospital said the incident did not affect all patient information and did not involve access to medical systems or electronic health records.
Company response
Ongoing disclosure — UMass Memorial
The hospital said it is mailing letters to patients advising them of a "data security incident" involving Blackbaud Inc.
Remediation — UMass Memorial
UMass Memorial said it has established a dedicated call center to answer any questions about this incident: (888)-604-0288.
Source excerpt
In July, Blackbaud informed UMass Memorial it found an unauthorized individual gained access to Blackbaud's systems between Feb. 7 and May 20.
UMass Memorial Medical Center announced Monday a vendor that handles donor and fundraising data for the hospital experienced a security breach earlier this year.
This incident did not affect all UMass Memorial patient information, UMass Memorial said in a press release Monday; it was limited to its donor and fundraising database and did not involve any access to medical systems or electronic health records.
2020
Northern Light Health discloses potential patient data theft
Issue disclosure
Northern Light Health stated that some patient information might have been stolen by hackers during a ransomware attack on Blackbaud. According to the notice, the potentially affected information included patient identifying and treatment details, while no credit card or bank account information was accessed. The disclosure described the incident as a possible theft of patient data connected to the Blackbaud ransomware attack and identified the categories of information that could have been involved.
Northern Light Health said some patient information might have been stolen by hackers during a ransomware attack on Blackbaud. The potentially affected information included patient identifying and treatment details; the notice said no credit card or bank account information was accessed.
Company response
Investigation — Northern Light Health
Northern Light Health said its investigation indicates that patient names, addresses, phone numbers, email addresses, date of birth, the hospital where the patient was treated, date of treatment and possibly the department where the patient was treated might have been stolen from Blackbaud.
Source excerpt
The attack, which began in February and was detected by Blackbaud in May, affected thousands of organizations, including nonprofits in Maine.
Northern Light Health said its investigation indicates that patient names, addresses, phone numbers, email addresses, date of birth, the hospital where the patient was treated, date of treatment and possibly the department where the patient was treated might have been stolen from Blackbaud.
Northern Light said it notified the federal Department of Health and Human Services of the data breach because it involved personal health care information
2020
NorthShore disclosed potential exposure of personal information
Issue disclosure
NorthShore University HealthSystem said that the personal information of about 348,000 people may have been exposed in a breach involving its vendor Blackbaud. Blackbaud said the breach resulted from a ransomware attack and that some data was accessed by a cybercriminal. The disclosure is recorded as a controversy note concerning Blackbaud, based on the event summary and source reporting.
NorthShore University HealthSystem said personal information of about 348,000 people may have been exposed in a breach involving its vendor Blackbaud. Blackbaud said the breach resulted from a ransomware attack and that some data was accessed by a cybercriminal.
Company response
Ongoing disclosure — NorthShore University HealthSystem
NorthShore recently sent a letter to those affected saying information including their full names, birth dates, addresses, phone numbers, doctors’ names, doctors’ offices and dates of admission and discharge may have been exposed.
Source excerpt
The Blackbaud breach was the result of a ransomware attack, in which cybercriminals attempt to lock companies out of their own data and servers and demand ransom in order to restore access, Blackbaud said in a statement on its website. Blackbaud discovered the attack in May. NorthShore learned of the breach July 22, according to the hospital’s letter.
NorthShore University HealthSystem said the personal information of about 348,000 people may have been exposed in a breach involving one of the health system’s vendors earlier this year.
NorthShore recently sent a letter to those affected saying information including their full names, birth dates, addresses, phone numbers, doctors’ names, doctors’ offices and dates of admission and discharge may have been exposed.
2020
OSF HealthCare notifies patients of vendor data incident
Issue disclosure
OSF HealthCare stated that an unauthorized individual accessed Blackbaud's systems between February 7 and May 20, 2020, and may have acquired backup copies of customer databases, including one used by OSF for fundraising. OSF said its review found some patient information in the affected database. It also stated that the incident did not involve access to its medical systems or electronic health records.
OSF HealthCare said an unauthorized individual accessed Blackbaud's systems between February 7 and May 20, 2020, and may have acquired backup copies of customer databases, including one used by OSF for fundraising. OSF said its review found some patient information in the affected database; it also stated that the incident did not involve access to its medical systems or electronic health records.
Company response
Ongoing disclosure — OSF HealthCare
OSF HealthCare System ("OSF") is mailing letters to its patients advising them of a data security incident
Investigation — OSF HealthCare
On August 20, 2020, OSF's investigation and review of the Blackbaud database involved in the incident determined that it contained some patient information
Remediation — OSF HealthCare
OSF is assessing the security safeguards at Blackbaud and evaluating the data elements stored on the Blackbaud systems.
Source excerpt
This incident did not involve any access to OSF's medical systems or electronic health records.
Blackbaud advised that the unauthorized individual may have acquired backup copies of databases used by its customers, including a backup of the database OSF uses for fundraising efforts.
Blackbaud notified its customers it discovered that an unauthorized individual gained access to Blackbaud's systems between February 7 and May 20, 2020.
2020
Blackbaud discloses ransomware attack and theft of client data
Issue disclosure
Blackbaud said it discovered and stopped a ransomware attack in May, and that the cybercriminal removed some client data. The company said it paid the criminal's demand for confirmation that the removed data had been destroyed.
Source excerpt
The cybercriminal removed some data, but the company clarified that the entity did not access credit card information, bank account information or social security numbers.
In a statement posted on its website in July, Blackbaud says it "discovered and stopped a ransomware attack" in May.
2020
Blackbaud breach exposed patient information held by OSF HealthCare
Issue disclosure
A security breach at Blackbaud between February 7 and May 20 exposed patient information, including names, contact details, birthdays, treatment facilities and treating physicians. OSF HealthCare said it was assessing Blackbaud’s security safeguards and evaluating the data stored on its systems.
Company response
Investigation — OSF HealthCare
“OSF is assessing the security safeguards at Blackbaud and evaluating the data elements stored on the Blackbaud systems,” OSF said in a news release.
Source excerpt
The breach at software company Blackbaud, which happened between Feb. 7 and May 20, exposed patient information such as names, addresses, phone numbers, email addresses, birthdays, treatment facilities and treating physicians.
“OSF is assessing the security safeguards at Blackbaud and evaluating the data elements stored on the Blackbaud systems,” OSF said in a news release.
2020
Nuvance Health discloses third-party data breach
Issue disclosure
Nuvance Health disclosed that patients’ information may have been exposed in a security breach involving Blackbaud, a third-party vendor, between February and May. The affected information may have included personal and health-related details; the report says financial account data and medical records were not involved.
Company response
Ongoing disclosure — Nuvance Health
which is mailing letters to patients advising them of a data security incident
Source excerpt
That’s according to a release from organization, which is mailing letters to patients advising them of a data security incident that involved Blackbaud, a third-party vendor that provides services on behalf of Nuvance.
Patients of Nuvance Health may have had their information exposed due to a security breach between February and May.
It’s believed that names, contact information, ages, gender, dates of birth, admission dates, departments of treatment, treating physicians and health insurance statuses were among the information affected, Nuvance announced.
2020
Blackbaud ransomware attack and data removal
Issue disclosure
Blackbaud suffered a ransomware attack. The article reports that the attack happened in February, the company noticed it in May, and a copy of data was secured before the hacker was removed. Blackbaud said no credit card, Social Security, or bank account information was taken and that it had no reason to believe the data was misused or publicly disseminated.
Source excerpt
No credit card information, social security numbers or bank account information was taken, Blackbaud said.
Before the hacker was removed from the system, they secured a copy of data.
The NonProfit Times reported the attack happened in February. Blackbaud noticed the attack in May, and independent forensics experts and law enforcement helped stop the hacker.