August 3, 2020
As a valued supporter of Dodge Nature Center and Preschool, I want to make you aware of a data security incident with a third-party vendor that may have involved your personal information. Dodge takes the protection and proper use of your information very seriously. I am contacting you to explain the incident and provide you with steps you can take to protect yourself.
What happened?
Blackbaud, the provider of our constituent database, notified us in late July 2020 of a ransomware attack on their systems. This breach impacted many organizations in the United States and United Kingdom, as Blackbaud is the world’s largest provider of nonprofit administration and fundraising software. It occurred at some point between February 7, 2020 and May 20, 2020.
After discovering the attack, Blackbaud’s cyber security team—together with independent forensics experts and law enforcement—successfully prevented the cybercriminal from blocking their access and fully encrypting files; and ultimately expelled them from their system. However, the cybercriminal removed a copy of backup files from many nonprofits, including Dodge.
What information was involved?
The cybercriminal did not access your credit card information, bank account information, driver’s license number or Social Security number. However, we have determined that the file removed may have contained:
Your contact information;
Demographic information and family relationships, including children’s names;
Event registrations;
A history of your relationship with Dodge, such as donation dates and amounts.
The Blackbaud company chose to pay the cybercriminal’s demand with confirmation that the copy they removed had been destroyed. Based on Blackbaud’s research, and third party (including law enforcement) investigation, they believe that no data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly.
What is Dodge doing?
I am notifying you so that you can take immediate action to protect yourself. Ensuring the safety of your data is of the utmost importance to all of us at Dodge.
As part of their ongoing efforts to help prevent something like this from happening in the future, Blackbaud has already implemented several changes that will protect your data from any subsequent incidents.
The Executive Committee of the Board of Directors is reviewing the incident and our donor privacy policy. We are evaluating our relationship with Blackbaud and speaking to peer nonprofits to gather their insights.
A very limited number of Dodge staff access our constituent database; they all utilize strong, secure passwords and change them regularly. Know that we will never ask you to transmit financial information over email.
What can you do?
Please remain vigilant and promptly report any suspicious activity or suspected identity theft to us and to the proper law enforcement authorities [Office of the Minnesota Attorney General at (800) 657-3787].
I sincerely apologize for this incident and regret any inconvenience it may cause you. Should you have any further questions or concerns regarding this matter and/or the protections available to you, please do not hesitate to contact me at 651-455-4531 or [email protected].
Sincerely,
Jason Sanders
Executive Director, Dodge Nature Center and Preschool