Cyber Incident Victim: Roper St. Francis Healthcare
Date:
Feb 2020
Location:
United States of America
Summary
Roper St. Francis Healthcare notified almost 93,000 patients of a data security breach involving Blackbaud that exposed information from its fundraising database. The accessed data may have included patients' names, ages, genders, dates of birth, addresses, dates of treatment, departments of service, and treating physicians, while Social Security numbers, financial account, and credit card information remained encrypted and unavailable to the attacker. The breach did not affect medical systems or electronic health records.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 31, 2020, Blackbaud notified Roper St. Francis Healthcare that an unauthorized party had gained access to its systems between February 7 and May 20, 2020. The intrusion allowed the attacker to obtain a backup copy of the database that manages fundraising information for Roper St. Francis Foundations. Roper St. Francis Healthcare then issued a breach notification to almost 93,000 patients on September 8, 2020, as reported by local news. The healthcare provider emphasized that the breach did not affect its medical systems or electronic health records.
The compromised fundraising database may have contained patients' names, ages, genders, dates of birth, addresses, dates of treatment, departments of service, and the names of treating physicians. Blackbaud confirmed that Social Security numbers, financial account details, and credit card information were encrypted and therefore not accessible to the unauthorized party. As a result, the potential exposure was limited to demographic and service‑related data rather than sensitive financial identifiers. Approximately ninety‑three thousand individuals were identified as possibly affected by the incident.
In response, Roper St. Francis Healthcare established a dedicated call center reachable at 1‑866‑938‑0447, operating Monday through Friday from 9 a.m. to 6:30 p.m., to address patient questions about the breach. The organization advised affected patients to review statements from their healthcare providers and to contact their provider immediately if they noticed services they did not receive. To reduce the risk of similar events, Roper St. Francis Healthcare began reviewing how information is stored with third‑party vendors and is re‑evaluating its relationship with Blackbaud. These steps constitute the provider’s documented response to the security incident.