Cyber Incident Victim: University of Birmingham
Date:
Sep 2020
Location:
United Kingdom
Summary
A ransomware attack targeting Blackbaud, a cloud services provider, compromised personal data of individuals associated with multiple UK universities including the University of Birmingham. Confidential information such as names, dates of birth, addresses, phone numbers, and email addresses was stolen, prompting legal investigations alleging insufficient data protection and violations of GDPR. The institution notified potentially affected parties and advised maintaining standard security precautions, while a law firm representing impacted individuals asserted claims for distress and privacy breaches could be pursued against the universities involved.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In July 2020, a ransomware attack targeted Blackbaud, a cloud computing provider serving educational institutions, compromising personal data of students, staff, and partners from multiple UK universities including the University of Birmingham. The attackers exfiltrated confidential information such as names, dates of birth, addresses, phone numbers, and email addresses. Blackbaud notified affected universities, including Birmingham, of the breach earlier in the summer of 2020. The University of Birmingham was among at least nine institutions confirmed to have had data exposed, alongside the Universities of Surrey, York, South Wales, Cumbria, Leeds, Newcastle, Reading, and King’s College London. No technical specifics regarding the attack vector, duration, or containment measures were disclosed in available reports.
Following the breach, law firm Simpson Millar initiated investigations and legal proceedings after hundreds of affected individuals from the universities expressed concerns. Robert Godfrey, Head of Professional Negligence at Simpson Millar, characterized the incident as a violation of GDPR and data protection rules, asserting that victims could claim compensation for distress, anxiety, and potential future targeting by malicious actors. The University of Surrey’s spokesperson confirmed immediate investigation and notification of potentially affected parties upon learning of the breach but maintained that no extraordinary security measures were required beyond routine precautions. No direct statements from the University of Birmingham regarding its response actions were documented in the source material. The incident’s scale prompted coordinated legal scrutiny across multiple institutions, with Simpson Millar publicly inviting affected individuals to seek counsel. Blackbaud declined to comment on the breach.