Cyber Incident Victim: Blackbaud
Date:
May 2020
Location:
United States of America
Summary
A cloud software provider serving nonprofits and educational institutions suffered a ransomware attack where attackers exfiltrated a subset of data before being expelled. The company paid the ransom despite claiming to have halted encryption early, then delayed notifying affected customers for two months. The incident highlighted ransomware actors' increasing use of data theft as extortion leverage, pressuring victims by threatening leaks. Payment occurred despite advisories against rewarding cybercriminals, who may not honor promises to delete stolen information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In May 2020, Blackbaud, a cloud software provider serving nonprofit and educational organizations, experienced a ransomware attack on its self-hosted environment. The company’s Cyber Security team detected the intrusion and collaborated with independent forensics experts and law enforcement to disrupt the attack before the ransomware fully encrypted files. Despite halting the encryption process and expelling the attacker from its systems, Blackbaud confirmed that the threat actor had exfiltrated a copy of a subset of data prior to being locked out. The company subsequently paid an undisclosed ransom to the attackers, though it did not publicly clarify the rationale for this decision. Blackbaud delayed notifying affected customers about the breach until July 2020—approximately two months after the incident—prompting concerns from clients about the lag in disclosure. The company issued a public statement and website advisory acknowledging the attack but declined to provide additional details beyond its initial announcement when questioned by media outlets.
The incident highlighted emerging ransomware tactics, where attackers increasingly exfiltrate data to pressure victims into paying ransoms, particularly when backups limit the effectiveness of encryption-based extortion. Blackbaud’s payment contradicted UK government guidance advising against rewarding cybercriminals, which emphasizes that ransoms sustain criminal enterprises and provide no guarantee of data recovery or deletion. While Blackbaud asserted its announcement timing was unrelated to contemporaneous high-profile Twitter account hijackings, the delayed notification compromised customers’ ability to promptly assess risks associated with the stolen data subset. The company did not disclose specific data types impacted or the number of affected organizations, nor did it confirm whether attackers honored their deletion agreement after receiving payment.