Boston University and WBUR notified donors on Saturday that some of their personal information may have been compromised. Blackbaud, a company that provides fundraising technology, says its client data was stolen.
It’s unclear how many organizations are affected by the data breach. Other media organizations are reporting that many nonprofits and higher education institutions are affected, and the BBC reports that at least 125 organizations in the United Kingdom have been affected.
In a statement posted on its website in July, Blackbaud says it “discovered and stopped a ransomware attack” in May. The company says it detected the attack in time to prevent the cybercriminal from blocking its system.
The cybercriminal removed some data, but the company clarified that the entity did not access credit card information, bank account information or social security numbers. In a statement, WBUR also confirmed that it does not store financial data of its donors so that information was not compromised.
“We have determined that the files involved may have contained contact information, demographic data and WBUR donor support details,” according to WBUR’s statement.
Blackbaud says it paid the cybercriminal’s demand to get confirmation that the copy of data they removed had been destroyed. The company did not disclose how much it paid the entity.
“Based on the nature of the incident, our research, and third party (including law enforcement) investigation, we have no reason to believe that any data went beyond the cybercriminal, was or will be misused; or will be disseminated or otherwise made available publicly,” Blackbaud said in a statement.
WBUR says its donors do not need to take any action at this time.
