There are a lot of issues I take with their response so far. Note: I am An admin that administers part of their product suite, that has mostly not been affecte

There are a lot of issues I take with their response so far. Note: I am An admin that administers part of their product suite, that has mostly not been affected to my Knowledge because we are mostly using heir products on-prem 1. This isn’t a ransomware attack in the traditional sense. They had an intrusion starting in February that they noticed in May because the actor was sending data offsite. They then held that data for ransom. That’s not ransomware, that’s getting hacked. 2. They will not tell people what specific data was exposed. Only “internal systems”. That may include things like customers that have on prem solutions but have to send backups of their DB for support etc. BLackbaud won’t say anything. 3. There is no way to confirm the malicious actors didn’t have copies of their own data that wasn’t deleted. It got out of their control and they lost all chain of custody. They are literally trusting criminals here as a way to say it’s not exposed (and hiring some firm to “monitor the dark web” for data) 4. While some data is encrypted, hows it’s encrypted in at least a few cases I know of isn’t exactly secure. For example in one product the encryption key is stored in a stored procedure packaged into their compiled installer and is placed into an ssis package on any sql instance the product is installed. It’s the same key for all customers (and I’ll just say isn’t randomized or very hard to iterate). If the actors got any access to their installers, all they would have to do is join the database to the installer and boom, encryption is useless.