Data Breach July 2020

The College has been affected by a data security incident with a third-party service provider, Blackbaud, one of the world’s largest providers of alumni relationship management systems. The College was one of a significant number of schools, higher education and non-profit organisations affected in the UK and in other countries.

We would like to assure alumni, donors and other contacts that we take our data protection responsibilities very seriously and since we were made aware of this incident, we have been investigating exactly what happened and working with Blackbaud to provide accurate information to those who may have been affected. Further details are provided below, including the steps we have taken in response.

 

There is no need for further action on the part of alumni or donors at this time other than the usual vigilance for anything unusual relating to personal data.

 

What happened?

Blackbaud informed us that they had been the victim of a ransomware attack between February and May 2020. Whilst they ultimately managed to lock the cybercriminal out of their systems, prior to this, the cybercriminal was able to remove a copy of a backup of a subset of data from a number of their clients. This included St Aloysius’ College data.

We use the system Blackbaud provides to record engagement with alumni, donors, potential donors, event attendees, and friends of the College. Based on the information provided to us by Blackbaud, we are sharing details of this breach of their systems with members of our community, whom we believe may have been affected. 

 

What information was involved?

We would like to reassure our community that: 

• a detailed forensic investigation was undertaken, on behalf of Blackbaud, by law enforcement and third-party cyber security experts; and

• Blackbaud have confirmed that the investigation found that no encrypted information, such as credit card information, bank account details or passwords, was accessible; 

The data accessed by the cybercriminal may have contained some of the following information:

• basic details e.g. name, title, gender, date of birth;

• addresses and contact details e.g. phone, email;

• a record of your engagement with alumni and fundraising activities e.g. enquiries, event participation, volunteering, donations, and any other interactions you have with us;

• professional details, e.g. the profession you work in and your employer; and

• information about your interests you have provided to us e.g. in response to one of our surveys.

 

What are we doing about the situation?

We have been informed that in order to protect customers’ data and mitigate potential identity theft, Blackbaud met the cybercriminal’s ransomware demand. Blackbaud has advised us that it paid the ransom and received assurances from the cybercriminal that the data had been destroyed.

However, we have immediately launched our own investigation and have taken the following steps:

• whilst we do not believe there is any specific risk to you as a result of this breach, we are notifying you so that you are aware and can remain vigilant; 

• we have contacted the Information Commissioner’s Office (ICO) and are following their guidance;

• we are working with Blackbaud to understand why there was a delay between them finding the breach and notifying us, as well as what actions they have taken to increase their security.

There is no need for you to take any specific action at this time. However, to reflect best practice, we recommend people remain vigilant and promptly report any suspicious activity or suspected identity theft to the proper authorities.

If anyone would like to contact a member of the Development team, please contact alumni@staloysius.org and someone will be in touch.

 

Next steps

 

We will continue to work with Blackbaud to investigate this matter and to discuss our future engagement with them.  We greatly regret that this incident occurred and sincerely apologise for any inconvenience that this data breach by Blackbaud may cause.

Please be assured that we take data protection very seriously and we are grateful for your continued support and engagement.

James Cluckie, Assistant Head Data Compliance Lead 

Caroline Notman, Director of Development and Alumni Relations