Cyber Incident Victim: Newcastle University
Date:
Sep 2020
Location:
United Kingdom
Summary
A ransomware attack targeting cloud provider Blackbaud compromised personal data of individuals associated with multiple UK universities, including Newcastle University. Confidential information such as names, dates of birth, addresses, phone numbers, and email addresses was stolen, prompting legal investigations alleging insufficient data protection measures by the institutions. Affected parties expressed concerns over potential future targeting and emotional distress, with legal representatives asserting violations of GDPR and data protection rules, potentially entitling victims to compensation for distress and privacy breaches. The institution notified impacted individuals but advised only routine security precautions were necessary following its investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In 2020, Newcastle University was among at least nine UK institutions affected by a ransomware attack targeting Blackbaud, a cloud computing provider serving educational and other organizations. The breach compromised confidential personal data belonging to students, staff, and university partners, including names, dates of birth, addresses, phone numbers, and email addresses. The attack occurred earlier in the year, with Blackbaud notifying affected universities during the summer of 2020. Newcastle University, alongside the University of Surrey, York, South Wales, Cumbria, Leeds, Birmingham, Reading, and King’s College London, confirmed their data held by Blackbaud had been accessed. The universities initiated investigations upon notification, determining that stolen information could have been leaked online. No technical specifics regarding the attackers’ methods or the exact timeline of intrusion were disclosed by the universities or Blackbaud.
Following the breach, law firm Simpson Millar launched investigations and legal proceedings after hundreds of affected individuals expressed concerns. Robert Godfrey, Head of Professional Negligence at the firm, characterized the incident as a clear violation of GDPR and data protection rules, asserting that universities bore ultimate responsibility for safeguarding personal data. Affected parties were advised they could pursue compensation claims for distress, anxiety about future targeting, and life disruption caused by the breach. The University of Surrey’s spokesperson—representative of the collective institutional response—stated affected individuals were promptly notified but required no specific remedial actions beyond routine online security precautions. Blackbaud declined to comment, while Simpson Millar publicly invited impacted individuals from all nine universities to seek legal advice through dedicated contact channels.