Blackbaud Data Incident

Blackbaud, a leading provider of cloud software and data intelligence used widely by leading independent schools, colleges, and universities around the country, was subject to an attempted ransomware attack that they learned about on May 14, 2020. Blackbaud, with the help of independent forensics experts and law enforcement, successfully prevented the cybercriminals from blocking the system access and fully encrypting files and expelled the cybercriminals from the network. During the incident, backup files containing information from numerous Blackbaud clients, including The Hill School, were stolen. Blackbaud paid the cybercriminals the demanded ransom to ensure the backup files were permanently destroyed and not made publicly available. The Hill School was notified of the data incident on July 16, 2020.

Upon receiving the notice of the incident on July 16, 2020, The Hill immediately retained data privacy legal counsel to further investigate the full scope of the incident. We worked closely with legal counsel, our Board legal committee, and Blackbaud to determine the implications of the incident as it relates to The Hill and what, if any, data may have been put at risk.  This internal due diligence required considerable careful review, and additional time, before our planned disclosure and notice to our constituency.

The data involved in this security breach was not on-site at The Hill, but rather it was hosted by Blackbaud. Blackbaud has informed us that no credit card information, bank account information, or usernames/passwords have been affected because that information was encrypted. Please note that The Hill does not collect or ask for Social Security numbers, so this information is not included in our database.

 

We hold the integrity of your personal information in the highest regard. We have made clear to our Blackbaud representatives how disappointed we are by the incident. Blackbaud has confirmed through testing by multiple third parties, including the appropriate platform vendors, that their fix withstands all known attack tactics. Additionally, the company is further enhancing its security controls and has already implemented several changes that will protect your data. Currently, a team of outside experts hired by Blackbaud is monitoring the dark web and private online channels on a constant 24/7/365 basis looking for any traces of the data involved in this incident. If there is any indication that such data is on the dark web, they will alert the School promptly and we will communicate immediately to our community members.