4 ms·

How was trusting the word of a bunch of criminals, with no reason to follow through with deleting the data, the correct course of action? Isn’t a failure to dis

How was trusting the word of a bunch of criminals, with no reason to follow through with deleting the data, the correct course of action? Isn’t a failure to disclose what data was comprised, and how, a breach of GDPR?

AznHisoka 6y ago
I forgot the exact GDPR laws but I think if they failed to disclose the security breach within 3 days of discovery they are subject to a fine of 4% of their revenue.
- scaryclam 6y ago
  Up-to 4% of their global revenue or €20,000,000 whichever is higher. Those are the maximum fines they can levy (per incident), but in reality it's very unlikely to be that high. And yes, you are correct, organisations have 72 hours to disclose the breach. The various data protection offices (such as the ICO in the UK) usually try to work with organisations first. If Blackbaud aren't playing ball though, they may be in for a rough ride (assuming that they actually operate where the EU has jurisdiction that is).
  - TimLangley 6y ago
    Slightly nitpicky but the 72 hour piece is wrong here A data controller has 72 hours to notify the ICO (or other supervisory authority). A data processor has no such obligation [unless specified as part of the data processing agreement DPA] Most DPA will state asap s.t the controller can notify But in this instance Blackbaud would almost certainly be a processor (It’s a neat [nasty] little loophole
    - jacquesm 6y ago
      Article 28 makes it a requirement that the processor and the controller arrange for this notification requirement to be arranged between them. A failure to do so by the processor would likely make them liable. The processor is only able to discharge itself from this liability if they notify the controller promptly. For more reading on this: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- Nextgrid 6y ago
  This would require someone willing to enforce the GDPR. So far the various data protection agencies have been very lazy.
croutonwagon 6y ago
There are a lot of issues I take with their response so far. Note: I am An admin that administers part of their product suite, that has mostly not been affected to my Knowledge because we are mostly using heir products on-prem 1. This isn’t a ransomware attack in the traditional sense. They had an intrusion starting in February that they noticed in May because the actor was sending data offsite. They then held that data for ransom. That’s not ransomware, that’s getting hacked. 2. They will not tell people what specific data was exposed. Only “internal systems”. That may include things like customers that have on prem solutions but have to send backups of their DB for support etc. BLackbaud won’t say anything. 3. There is no way to confirm the malicious actors didn’t have copies of their own data that wasn’t deleted. It got out of their control and they lost all chain of custody. They are literally trusting criminals here as a way to say it’s not exposed (and hiring some firm to “monitor the dark web” for data) 4. While some data is encrypted, hows it’s encrypted in at least a few cases I know of isn’t exactly secure. For example in one product the encryption key is stored in a stored procedure packaged into their compiled installer and is placed into an ssis package on any sql instance the product is installed. It’s the same key for all customers (and I’ll just say isn’t randomized or very hard to iterate). If the actors got any access to their installers, all they would have to do is join the database to the installer and boom, encryption is useless.

AznHisoka 6y ago

I forgot the exact GDPR laws but I think if they failed to disclose the security breach within 3 days of discovery they are subject to a fine of 4% of their revenue.

scaryclam 6y ago
Up-to 4% of their global revenue or €20,000,000 whichever is higher. Those are the maximum fines they can levy (per incident), but in reality it's very unlikely to be that high. And yes, you are correct, organisations have 72 hours to disclose the breach. The various data protection offices (such as the ICO in the UK) usually try to work with organisations first. If Blackbaud aren't playing ball though, they may be in for a rough ride (assuming that they actually operate where the EU has jurisdiction that is).
- TimLangley 6y ago
  Slightly nitpicky but the 72 hour piece is wrong here A data controller has 72 hours to notify the ICO (or other supervisory authority). A data processor has no such obligation [unless specified as part of the data processing agreement DPA] Most DPA will state asap s.t the controller can notify But in this instance Blackbaud would almost certainly be a processor (It’s a neat [nasty] little loophole
  - jacquesm 6y ago
    Article 28 makes it a requirement that the processor and the controller arrange for this notification requirement to be arranged between them. A failure to do so by the processor would likely make them liable. The processor is only able to discharge itself from this liability if they notify the controller promptly. For more reading on this: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
Nextgrid 6y ago
This would require someone willing to enforce the GDPR. So far the various data protection agencies have been very lazy.

croutonwagon 6y ago

There are a lot of issues I take with their response so far. Note: I am An admin that administers part of their product suite, that has mostly not been affected to my Knowledge because we are mostly using heir products on-prem 1. This isn’t a ransomware attack in the traditional sense. They had an intrusion starting in February that they noticed in May because the actor was sending data offsite. They then held that data for ransom. That’s not ransomware, that’s getting hacked. 2. They will not tell people what specific data was exposed. Only “internal systems”. That may include things like customers that have on prem solutions but have to send backups of their DB for support etc. BLackbaud won’t say anything. 3. There is no way to confirm the malicious actors didn’t have copies of their own data that wasn’t deleted. It got out of their control and they lost all chain of custody. They are literally trusting criminals here as a way to say it’s not exposed (and hiring some firm to “monitor the dark web” for data) 4. While some data is encrypted, hows it’s encrypted in at least a few cases I know of isn’t exactly secure. For example in one product the encryption key is stored in a stored procedure packaged into their compiled installer and is placed into an ssis package on any sql instance the product is installed. It’s the same key for all customers (and I’ll just say isn’t randomized or very hard to iterate). If the actors got any access to their installers, all they would have to do is join the database to the installer and boom, encryption is useless.