July 27, 2020
As a valued member of the VMI family, we are informing you that Blackbaud, Inc., one of our third-party service providers, discovered and stopped a ransomware attack on their servers that compromised some data of many of their clients, including the VMI Alumni Agencies. Please note that based on the information we currently have, the cybercriminal attack on Blackbaud did not access credit card information, bank account information, passwords, or any other private financial data. As responsible stewards of your trust, we thought it best to alert you.
What Information Was Involved?
The file removed may have contained information including names, birthdates, mailing addresses, email addresses, phone numbers, giving histories and notes on your support. Because protecting customers’ data is their top priority, Blackbaud paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed. Based on the nature of the incident, their research, and third party (including law enforcement) investigation, there is currently no evidence that any data went beyond the cybercriminal.
We want to reiterate that the Alumni Agencies do not ask for or store social security numbers, which means that data was not available to the cybercriminal. Additionally, the Agencies encrypt all credit card information, which means that neither the cybercriminal nor the Agencies can see the number itself.
What Has Been Done to Resolve this Issue?
Blackbaud’s teams were able to quickly identify the vulnerability associated with this incident, including the tactics used by the cybercriminal, and took swift action to fix it. They have confirmed through testing by multiple third parties, including the appropriate platform vendors, that the fix withstands all known current attack tactics. Additionally, they are accelerating efforts to further strengthen their environment.
What You Can Do
As a best practice, we recommend you remain vigilant and promptly report any potential suspicious activity or suspected identity theft to the proper law enforcement authorities.
For More Information
You can read more about this incident on Blackbaud’s website HERE. Should you have any further questions please do not hesitate to contact me.
We stay committed to protecting your trust in us and continue to be thankful for your support.
Sincerely,
Stephen M. Maconi
CEO, VMI Alumni Agencies