Blackbaud Security Incident
Please be advised that a data security incident has occurred involving a third-party service provider, Blackbaud, that provides database services to the SUNY Empire State College Foundation. This incident has been thoroughly examined by the vendor, law enforcement, independent forensics experts, and the college’s Information Technology Services team, and there is currently no reason to believe that any sensitive information of yours has been compromised. We are posting this notification in the interest of full transparency because we highly value our relationship with SUNY Empire Alumni.
We were recently notified by Blackbaud of a security incident in which they discovered and stopped a ransomware attack. After discovering the attack, the service provider’s Cyber Security team — together with independent forensics experts and law enforcement — successfully prevented the cybercriminal from blocking their system access and fully encrypting files; and ultimately expelled them from their system. Prior to locking the cybercriminal out, the cybercriminal removed a copy of a backup file containing personal information from our alumni records. This occurred at some point beginning on February 7, 2020 and they could have been in there intermittently until May 20, 2020.
What Information Was Involved
It’s important to note that we do not hold your credit card information, bank account information or social security numbers within our databases therefore, the cybercriminal did not access your credit card information, bank account information, or social security number. However, we have determined that the file removed may have contained information such as contact information, demographic information, and a history of your relationship with our organization.
What Actions Have Been Taken
Because protecting customers’ data is their top priority, Blackbaud worked with law enforcement to confirm that any information the cybercriminals removed has been destroyed. Based on the nature of the incident, their research, and third party (including law enforcement) investigation, we have no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly. We are notifying you so that you can take immediate action to protect yourself. Ensuring the safety of your data is of the utmost importance to us. As part of their ongoing efforts to help prevent something like this from happening in the future, Blackbaud has already implemented several changes that will protect your data from any subsequent incidents.
What You Can Do
As a best practice, we recommend you remain vigilant and promptly report any suspicious activity or suspected identity theft to the proper law enforcement authorities.
How the SUNY Empire State College Foundation Handles Your Information
The SUNY Empire Foundation supports the highest standards of conduct regarding privacy rights and confidentiality. We follow industry standards and adhere to the laws and regulations designed for safeguarding our alumni data.
For More Information
Should you have any further questions or concerns regarding this matter, please do not hesitate to contact Kim Neher at the SUNY Empire Office for Advancement.