Blackbaud: Ransomware Gang Had Access To Banking Info And Passwords

Blackbaud, a leading cloud software provider, confirmed that the threat actors behind the May 2020 ransomware attack had access to unencrypted banking and login information, as well as social security numbers.

The US-based company listed on NASDAQ is headquartered in Charleston, South Carolina, and it has operations in multiple countries including the United States, the United Kingdom, Australia, and Canada.

The security incident Blackbaud refers to was disclosed in a press release issued on July 16, 2020, when the company said that the attackers were blocked before fully encrypting systems but not before they were able to steal a “copy of a subset of data” from a self-hosted (private cloud) environment.

Subsequently, the cloud provider paid the ransom after receiving confirmation from the attackers that the stolen data was destroyed.

The list of organizations directly affected by the ransomware attack on Blackbaud includes a long list of entities including charities, non-profits, foundations, and universities from the United States, Canada, the United Kingdom, and the Netherlands.

Banking info and credentials exposed in the attack

While Blackbaud initially said that the ransomware gang behind the attack was not able to “access credit card information, bank account information, or social security numbers,” it later discovered after a forensic investigation that the threat actors had access to unencrypted banking info, credentials, and SSNs.

“After July 16, further forensic investigation found that for some of the notified customers, the cybercriminal may have accessed some unencrypted fields intended for bank account information, social security numbers, usernames and/or passwords,” Blackbaud said in an 8-K filing with the U.S. Securities and Exchange Commission (SEC).

“In most cases, fields intended for sensitive information were encrypted and not accessible,” the company further explained.

“These new findings do not apply to all customers who were involved in the Security Incident,” the filing also reads.

“Customers who we believe are using these fields for such information are being contacted the week of September 27, 2020, and are being provided with additional support.”

Blackbaud also said that the forensic investigation regarding the May ransomware attacks is still ongoing and that the company will continue to keep customers, stockholders, and other stakeholders informed of any new developments.

Also Read: Data Centre Regulations Singapore: Does It Help To Progress?

First the ransomware attack, then the data breach

Depending on the ransomware gang who stole Blackbaud’s data, its willingness to actually destroy it, and what it intends to do with it if it wasn’t actually destroyed as promised, the company’s customers may be facing a wide range of security risks given the extremely sensitive nature of the exposed information.

At the moment, BleepingComputer knows of 22 ransomware operations known to steal sensitive documents from victims’ servers before encryption.

The data stolen in these attacks is used for leverage when trying to convince the attacked organizations to pay the ransoms.

The companies are threatened that their stolen data will be gradually leaked until the ransom is paid and that, in some cases, the ransom will also increase until the entire batch of stolen documents is leaked on sites designed for this purpose.

Maze ransomware operators were the first ransomware operation known to publish Allied Universal’s stolen data for not paying the ransom in November 2019.

Even though they first started publishing the data in hacker forums posts they ultimately switched to a dedicated data leak site.

Also Read: How Bank Disclosure Of Customer Information Work For Security