fbpx

Blackbaud Ransomware Attack and Data Breach Pennsylvania Class Action

Blackbaud provides cybersecurity for information from schools, healthcare organizations, and nonprofits, among other types of groups. The complaint for this class action alleges, “Between February 7, 2020 and May 20, 2020, cyber criminals orchestrated a ransomware attack and infiltrated inadequately protected computer networks maintained by Blackbaud, a software company based in Charleston County, South Carolina.”

The class for this action is all individuals living in Pennsylvania whose PII and PHI was exposed because of the data breach at Blackbaud.

The data exposed in the data breach was personally identifying information (PII) and personal health information (PHI) for students, patients, donors, and other parties associated with the information in its systems. It included such things as Social Security numbers, user names, passwords, bank account information, information pertaining to medical treatments. Because the notice for the data breach told victims to monitor suspicious activity on their credit reports and accounts, the complaint says, it is possible that credit card numbers and other such PII may also have been compromised.

In July 2020, Blackbaud put an announcement on its website saying that it had suffered a ransomware attack, had paid the ransom and had received “confirmation that the copy they removed had been destroyed.”

The complaint charges that the systems were “incompetently secured…” It claims that Blackbaud failed to do a number of things to prevent such a breach. For example,

  • It failed to “timely implement adequate and reasonable measures” to protect the information.
  • It failed to prevent the breach or to detect it promptly.
  • It failed to “honor its repeated promises and representations to protect” the PII and PHI.
  • It failed to identify all information that was accessed.
  • It failed to “properly train employees regarding ransomware attacks[.]”
  • It failed to give the victims “any redress for the Data Breach.”

The complaint points out that Blackbaud said it had “already implemented changes to prevent this specific issue from happening again.” According to the complaint, this means that “had these changes been in place earlier, this incident would not have happened and [the victims’] Personal Information would not have been compromised.”

According to the complaint, Christina Duranko, the plaintiff in this case, worries about the possibility of her medical information being manipulated: “The consequences would be devastating because [Duranko’s] future medical treatment would rely on inaccurate medical and treatment histories.”

The complaint alleges that Blackbaud should be held responsible “for its grossly negligent—indeed, reackless—failure to use statutorialy required or reasonable cybersecurity measures to protect” the victims of this data breach.

Article Type: Lawsuit
Topic: Privacy

Most Recent Case Event

Blackbaud Ransomware Attack and Data Breach Pennsylvania Complaint

December 18, 2020

Blackbaud provides cybersecurity for information from schools, healthcare organizations, and nonprofits, among other types of groups. The complaint for this class action alleges, “Between February 7, 2020 and May 20, 2020, cyber criminals orchestrated a ransomware attack and infiltrated inadequately protected computer networks maintained by Blackbaud, a software company based in Charleston County, South Carolina.”

Blackbaud Ransomware Attack and Data Breach Pennsylvania Complaint

Case Event History

Blackbaud Ransomware Attack and Data Breach Pennsylvania Complaint

December 18, 2020

Blackbaud provides cybersecurity for information from schools, healthcare organizations, and nonprofits, among other types of groups. The complaint for this class action alleges, “Between February 7, 2020 and May 20, 2020, cyber criminals orchestrated a ransomware attack and infiltrated inadequately protected computer networks maintained by Blackbaud, a software company based in Charleston County, South Carolina.”

Blackbaud Ransomware Attack and Data Breach Pennsylvania Complaint
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy