15 ms·
Blackbaud hack: More UK universities confirm breach
- arethuza 6y agoOur son is at Exeter University and they notified me a couple of days ago about this - they identified Blackbaud as the service that had the problem.
- iso1210 6y agoYup, we received emails from them about it - we graduated nearly 20 years ago. I guess that's the price you pay when you say "yes, send me an alumni email every so often"
- smart_jackal 6y agoI've read in some article that insurance companies are actually encouraging the hackers by forcing their insured victims to pay the ransom instead of try to recover on their own or fight back the hackers in any way.
- JackFr 6y agoThat’s the way it works with liability insurance — if you want the coverage, it’s up to them, not you whether you settle or fight. But one would hope in the insurers are smart enough not to encourage bad behavior.
- KineticLensman 6y agoI received an apology email from my Alma Mater. Here's an extract. The last para makes an explicit statement that Blackbaud paid the ransom. On Thursday, 16 July, we were made aware of a security incident involving one of our third-party service providers, Blackbaud. Blackbaud is one of the world's largest providers of customer relationship management systems for the higher education and not-for-profit sectors. It informed us that in May it had discovered and stopped a ransomware attack on its systems, although some data was compromised. A number of universities using its services have been affected, including the University of Leeds. The company assures us that data compromised in the incident was comparatively low risk and did not contain any password, bank account or credit card information. We are continuing to work closely with Blackbaud to determine exactly what personal data was compromised. We understand that other clients of Blackbaud have been affected in different ways, with varying types of data involved. In our case, it appears that names and email addresses for some members of our alumni and supporter community were affected. Information on the sums given as gifts or event payments through the alumni web portal, Leeds Alumni Online, may also have been affected, although not any bank account or credit card details. As we understand that you haven’t used our website to make any financial transactions, this aspect will not affect you. Blackbaud paid a ransom to the cybercriminal and received assurances that the stolen data was destroyed and not used or sold on to third parties. Blackbaud says that – based on the nature of the incident, its research, and investigation by third parties (including law enforcement) – it has no reason to believe any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly.
- heavenlyblue 6y ago> No reason to believe it went beyond the cyber criminal. They have a really corporate sense of humour.
- KineticLensman 6y agoIndeed. Needless to say this is my reason for finally getting off their mailing list.
- thinkingemote 6y agoIt's bizarre but these criminals need to establish trust generally. If victims believed that a ransom wouldn't do anything they would not pay them as much. I think there's a parallel with kidnapping in some countries, it's almost business like.
- toyg 6y agoYou can bet that if kidnappers could make an identical copy of the victim in order to profit from him further down the line, most of them would. I fully expect this data to surface in a year or so.
- heavenlyblue 6y agoCan you imagine having a Chief We-have-been-pwned Officer who is responsible for building relationships with criminals so that they would actually delete your data rather than resurface it years later when nobody remembers (not even you) you having lost it?
- heavenlyblue 6y agoThe funny thing in this is that the criminals are pseudonymous at best and you can clone pseudonyms as much as you like. Also have you never worked for a corporation? My first thought is that the management went for the first most obvious solution that is paying the money.
- 6y ago
- cnorthwood 6y agoThis must be phonetically confusing to the very different piece of software also used a lot in the HE sector: Blackboard. I have also received this from the University of York. The timescales in play here seem terrible from Blackbaud's discovery to initial report.
- tremon 6y agoSame here, I assumed this was the name of an exploit against the BlackBoard software (student/class management).
- save_ferris 6y ago> The timescales in play here seem terrible from Blackbaud's discovery to initial report. That’s going to keep happening until someone gets the book thrown at them for slow-walking a response. I know this is a pretty anti-regulatory crowd, but we can’t expect this behavior to change if there are no consequences.
- zepto 6y agoConsequences don’t have to be regulatory. How about an opt-in scoreboard or ratings system for responses, with some objective criteria? Regulation would need to be based on objective criteria anyway, so why not develop them as an industry?
- IshKebab 6y agoWait they paid a ransom for the hackers to "delete" a copy of the data? That's insane.
- timothevs 6y agoThey insist the hackers ‘verifiably’ deleted their copy of the data. I’d like to see how one verifies that ‘all’ copies were destroyed.
- aboringusername 6y agoAsks for ransom to delete data Press release goes out, saying the data was "deleted" Send another ransom, maybe 5 BTC, otherwise data is released Insert taps on head meme
- toyg 6y agoSecond time around, there is no real incentive to pay - fool me once etc etc Imho it’s much better to just sit on it for a few months, then hit the usual forums to market it as high-quality data.
- TheOtherHobbes 6y agoThe incentive to pay is that it nukes Blackbaud's credibility and trustworthiness, and likely destroys the entire business. To a criminal that's easily worth an ask of 5BTC - or perhaps x% of annual profits in perpetuity. An extortion scam is likely to be worth more than the data.
- toyg 6y agoReputational damage happens anyway, once news of the first breach/ransom goes out (which it will, it’s increasingly mandated by law). Second time around they might as well fold. A prolonged extortion scheme can only be done on a low-scale highly-targeted basis, where you can ensure word doesn’t get out.
- timothevs 6y agoNot at liberty to say which Unis, but this is much wider than initially reported. A lot of American universities were affected as well. They are still measuring the fallout, and how best to respond. We were only told last week.
- lol768 6y agoFor those unfamiliar, Blackbaud produce software that is (mainly) used for harassing^W updating alumni on university developments and asking them for money. I think Raiser's Edge is used quite a bit in the sector, though I believe there are on-prem as well as cloud variants of the software?
- codeulike 6y agoThe on-prem Raiser's Edge hasn't been updated in a long time and is being phased out with the preference being for RENXT cloud version. A lot of charities use Raiser's Edge, I wonder if they are also affected? Although that BBC report says "One of the affected institutions told the BBC the hack is affecting a product called NetCommunity which Blackbaud describes on its website as an 'alumni engagement and management software system for nonprofits.'" ... so maybe Raiser's Edge was not part of the hack
- kogus 6y agoI believe this incident affected only customers who use classic RE hosted by Blackbaud. RE NXT is hosted in Azure and wasn’t affected.
- croutonwagon 6y agoNo true. Other products were definitely affected. We don’t use RE. But we do use other products and were alerted.
- kogus 6y agoGood to know. BBCRM?
- Nextgrid 6y agoHow does asking for money make sense in case of for-profit, paid universities? You're saying that people pay them a significant amount of money for tuition, complete it, and now the university is asking for more money?
- aronpye 6y agoHow was trusting the word of a bunch of criminals, with no reason to follow through with deleting the data, the correct course of action? Isn’t a failure to disclose what data was comprised, and how, a breach of GDPR?
- AznHisoka 6y agoI forgot the exact GDPR laws but I think if they failed to disclose the security breach within 3 days of discovery they are subject to a fine of 4% of their revenue.
- scaryclam 6y agoUp-to 4% of their global revenue or €20,000,000 whichever is higher. Those are the maximum fines they can levy (per incident), but in reality it's very unlikely to be that high. And yes, you are correct, organisations have 72 hours to disclose the breach. The various data protection offices (such as the ICO in the UK) usually try to work with organisations first. If Blackbaud aren't playing ball though, they may be in for a rough ride (assuming that they actually operate where the EU has jurisdiction that is).
- TimLangley 6y agoSlightly nitpicky but the 72 hour piece is wrong here A data controller has 72 hours to notify the ICO (or other supervisory authority). A data processor has no such obligation [unless specified as part of the data processing agreement DPA] Most DPA will state asap s.t the controller can notify But in this instance Blackbaud would almost certainly be a processor (It’s a neat [nasty] little loophole
- jacquesm 6y agoArticle 28 makes it a requirement that the processor and the controller arrange for this notification requirement to be arranged between them. A failure to do so by the processor would likely make them liable. The processor is only able to discharge itself from this liability if they notify the controller promptly. For more reading on this: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- JackFr 6y agoI’m sure the appropriate sanction for Blackbaud would bankrupt the company. While that is probably the best outcome long term, it doesn’t help anyone now.
- omerhj 6y agoThe ACLU has been affected as well. From the email they sent out yesterday: In all candor, we are frustrated with the lack of information we've received from Blackbaud about this incident thus far. The ACLU is doing everything in our power to ascertain the full nature of the breach, and we are actively investigating the nature of the data that was involved, details of the incident, and Blackbaud's remediation plans. We are also exploring all options to ensure this does not happen again, including revisiting our relationship with Blackbaud.
- amandahugg 6y agoThrowaway account - I am in charge of IT from one of the universities affected and am angry at how blackbaud has been so slow at communicating this to us. Even when we asked them the exact fields/data that was stolen they just gave us vague answers. Our contract with them ends soon and we will definitely not be renewing when it’s up.
- jacquesm 6y agoSuch a breach could easily count as reason to annul the contract.
- guitarbill 6y agotrue. but it usually isn't worth the effort, as that would involve getting lawyers involved. easier to not renew. plus most places will need some time to put an alternative in place. it's commendable if anybody manages to convince management and does this though. inertia and i imagine blackbaud did provide significant value/functionality?
- stordoff 6y agoSelwyn's statement notes much the same: > On 16th July, Blackbaud informed us of a data security incident [...] they had been the victim of a ransomware attack between February and May 2020. > Amongst the information that may been affected were the following[...] > Blackbaud is unable to confirm precisely which individual records have been affected https://www.selwynalumni.com/main-website-pages/blackbaud-data-breach https://www.selwynalumni.com/main-website-pages/blackbaud-da...
- kbutler 6y agoThe individual party incentives in ransomware are all to pay it, which encourages future attacks, only the long-term, societal view discourages payment. The victim (individual organization or SaaS provider) wants to just have it end. The ransomer has the incentive to build the pattern of "pay the ransom and nobody gets hurt [in this incident]", because it builds the business model. Cybersecurity insurance exacerbates the problem, because the insurer knows that payouts solve the incident for the insured at a relatively low cost, and that each incident perversely increases the need organizations have for the insurance. Conversely, if no one pays ransoms, it immediately ceases being a viable criminal business model.
- deleted 6y ago[deleted]