--- title: "Blackbaud ransomware attack: How nonprofits should respond" description: If you were one of the many nonprofits notified of the Blackbaud ransomware attack you may be weighing what to do next. Here are our thoughts. image: https://blog.rkdgroup.com/hubfs/210108-RKD-Blackbaud-ransomware-attack-How-nonprofits-should-respond-Doodle-v2.jpg --- [![](https://blog.rkdgroup.com/hs-fs/hubfs/210111-RKD-Groupthinkers-Rebranded-Logo-Blog-png.png?width=157&name=210111-RKD-Groupthinkers-Rebranded-Logo-Blog-png.png)](https://blog.rkdgroup.com) - [Solutions](https://rkdgroup.com/services/) - [Mid-Level Giving](https://rkdgroup.com/services/mid-level-giving/) - [Monthly Giving](https://rkdgroup.com/services/monthly-giving/) - [Lapsed Giving](https://rkdgroup.com/services/lapsed-giving/) - [Personalization](https://rkdgroup.com/services/personalization/) - [Connectors](https://rkdgroup.com/services/connectors/) - [Machine Learning](https://rkdgroup.com/services/machine-learning/) - [Marketing + Fundraising](https://rkdgroup.com/services/marketing-fundraising/) - [Audience Development](https://rkdgroup.com/services/audience-development/) - [Creative Services](https://rkdgroup.com/services/creative-services/) - [Data Management](https://rkdgroup.com/services/data-management/) - [Strategic Planning](https://rkdgroup.com/services/strategic-planning/) - [Analytics](https://rkdgroup.com/services/analytics/) - [Causes](https://rkdgroup.com/causes/) - [Animal Care](https://rkdgroup.com/causes/animal-care/) - [Food Banks](https://rkdgroup.com/causes/food-banks/) - [Health + Hospitals](https://rkdgroup.com/causes/health-hospitals/) - [Humanitarian](https://rkdgroup.com/causes/humanitarian/) - [Missions](https://rkdgroup.com/causes/missions/) - [Salvation Army](https://rkdgroup.com/causes/the-salvation-army/) - [Results](https://rkdgroup.com/results/) - [Acquisition](https://rkdgroup.com/results?cat=acquisition) - [Digital](https://rkdgroup.com/results?cat=digital) - [Mid-Major Programs](https://rkdgroup.com/results?cat=mid-major-programs) - [Advanced Analytics](https://rkdgroup.com/results?cat=advanced-analytics) - [Direct Mail](https://rkdgroup.com/results?cat=direct-mail) - [Multichannel Strategy](https://rkdgroup.com/results?cat=multichannel-strategy) - [Data Management](https://rkdgroup.com/results?cat=data-management) - [Media](https://rkdgroup.com/results?cat=media) - [Website Development](https://rkdgroup.com/results?cat=website-development) - [Resources](https://rkdgroup.com/insights/) - [Blog](https://blog.rkdgroup.com/) - [Benchmarks](https://info.rkdgroup.com/benchmarks) - [Webinars](https://info.rkdgroup.com/webinars) - [Ebooks + Research](https://info.rkdgroup.com/ebooks-research) - [Podcast](https://info.rkdgroup.com/group-thinkers-nonprofit-marketing-podcast) - [Field Guides](https://info.rkdgroup.com/field-guides) - [About Us](https://rkdgroup.com/about/) - [Leadership](https://rkdgroup.com/about/leadership/) - [Careers](https://rkdgroup.com/about/careers/) - [Let's Chat](https://rkdgroup.com/lets-chat/) #### Subscribe to our blog ### Subscribe to Email Updates ## Featured Post   [RKD Group](https://blog.rkdgroup.com/author/rkd-group) ## [What happens when a 'long shot' becomes the leader? | Susan Blouch, Lebanon Rescue Mission](https://blog.rkdgroup.com/what-happens-when-a-long-shot-becomes-the-leader-susan-blouch-lebanon-rescue-mission) “They are never going to give this job to a woman,” a friend told Susan Blouch. [Podcast](https://blog.rkdgroup.com/topic/podcast) [Missions](https://blog.rkdgroup.com/topic/missions) [Read More](https://blog.rkdgroup.com/what-happens-when-a-long-shot-becomes-the-leader-susan-blouch-lebanon-rescue-mission)   [Shane Thornal](https://blog.rkdgroup.com/author/shane-thornal) ## [Why nonprofits must unite SEO, social and paid media in one strategy](https://blog.rkdgroup.com/why-nonprofits-must-unite-seo-social-and-paid-media-in-one-strategy) Someone at your organization “owns” paid media. Someone else—often younger and under resourced—runs the social accounts. A third person (or maybe no one\[...\] [Digital Fundraising](https://blog.rkdgroup.com/topic/digital-fundraising) [SEO](https://blog.rkdgroup.com/topic/seo) [Digital Media](https://blog.rkdgroup.com/topic/digital-media) [Social Media](https://blog.rkdgroup.com/topic/social-media) [Data & Analytics](https://blog.rkdgroup.com/topic/data-analytics) [Read More](https://blog.rkdgroup.com/why-nonprofits-must-unite-seo-social-and-paid-media-in-one-strategy) ## Recent Posts [Data Privacy](https://blog.rkdgroup.com/topic/data-privacy) [Nonprofit Industry](https://blog.rkdgroup.com/topic/nonprofit-industry) # Blackbaud ransomware attack: How nonprofits should respond By [RKD Group](https://blog.rkdgroup.com/author/rkd-group) We are living in a time when [data privacy is a top concern](https://info.rkdgroup.com/donors-and-data) for individuals. Given recent events, it’s easy to see why. ![RKD-Blog—blackbaud-Graphic-1-v1](https://blog.rkdgroup.com/hs-fs/hubfs/RKD-Blog%E2%80%94blackbaud-Graphic-1-v1.jpg?width=600&name=RKD-Blog%E2%80%94blackbaud-Graphic-1-v1.jpg) As many nonprofits already know, Blackbaud fell victim to a ransomware attack in May 2020. This was a hard hit during an already tough year for nonprofits. If you’re grappling with how to handle the fallout of this data hack, both internally as an organization and externally with donors, [you’re not alone](https://blog.rkdgroup.com/nonprofit-fraud-attacks). We’ve had several clients reach out for our perspective. Read on for more about the attack, how nonprofits are responding and our advice for what you should be doing now and in the future. ### What nonprofits need to know On July 16, hundreds of nonprofits across the globe received notice of a [ransomware attack on Blackbaud](https://www.zdnet.com/article/cloud-provider-stopped-ransomware-attack-but-had-to-pay-ransom-demand-anyway/) that occurred in May 2020. The attackers gained access to donor data and were able to remove a subset of data from their self-hosted environment. The attack did not include their CRM or eCRM solutions. Although this stolen data contains no encrypted data, passwords or financial details, it could include personal information, student and donor ID numbers, addresses and contact details, donations, records of an engagement or other activities and professional details. All of this information is highly valuable in a targeted phishing attack. Blackbaud [released a statement](https://www.blackbaud.com/securityincident) saying they paid an undisclosed amount to the ransomware attackers for a “certificate of destruction.” However, it may be difficult to determine whether copies of this information were made before the original data was destroyed. ### How other organizations are responding As this incident gains global attention, nonprofits are weighing how to respond. Some organizations have chosen to share the breach with their donors. This has happened in several ways, but the most common has been through a notice on their website, through email or via direct mail. Others have taken it a step further, making the choice to [end their contracts](https://nonprofitquarterly.org/blackbaud-pays-ransom-demand-but-how-much-damage-is-done/) with Blackbaud. And while these conversations and tough decisions happen internally, nations like the United Kingdom are [investigating the delay in notice](https://www.bbc.com/news/technology-53528329). Under the [General Data Protection Regulation](https://gdpr.eu/) (GDPR), significant data breaches must be reported by companies to authorities within 72 hours of learning of the incident. Since this took place in May - and organizations weren’t notified until July - Blackbaud’s compliance is being called into question. ### What nonprofits should be doing We frequently discuss the importance of adopting a data-driven future. But to do this effectively, we must all also embrace a data-centric security strategy. Nonprofits have a duty to act as responsible stewards of their donors’ data. Recent events should serve as a reminder to conduct frequent data governance review policies. How can you do this? We suggest you begin to review your internal policies and your web privacy statements to understand your organization’s requirements. When something like this happens, make sure communication to the members of your organization is clear and consistent. Then, determine whether your organization will be sending out communication regarding the breach to donors, volunteers and event attendees. Here’s what you should consider as you make this decision: ![200730-RKD-Blog—Blackbaud-ransomware-attack-Graphic-2-v3](https://blog.rkdgroup.com/hs-fs/hubfs/200730-RKD-Blog%E2%80%94Blackbaud-ransomware-attack-Graphic-2-v3.png?width=1250&name=200730-RKD-Blog%E2%80%94Blackbaud-ransomware-attack-Graphic-2-v3.png) As individual privacy concerns grow and more data privacy regulations appear, it’s important to also assess your third-party vendor and agency compliance policies. Moving forward, these assessments should be standard practice for your organization. If adopted, they can help ensure you are prepared for any incidents that arise in the future. #### Want more info about donor privacy? Check out these related pieces: - [Donors and data: Where do we draw the line? (eBook)](https://info.rkdgroup.com/donors-and-data)  - [How does CCPA affect nonprofits? We asked an expert](https://blog.rkdgroup.com/how-does-ccpa-affect-nonprofits)  - [Privacy changes put emphasis on first-party data](https://blog.rkdgroup.com/privacy-changes-put-emphasis-on-first-party-data)  - [Is your nonprofit a target for a fraud attack?](https://blog.rkdgroup.com/nonprofit-fraud-attacks) ### [RKD Group](https://blog.rkdgroup.com/author/rkd-group) RKD Group is North America's leading fundraising and marketing services provider to hundreds of nonprofit organizations, including hospitals, social service, disease research, animal welfare, rescue missions, and faith-based charities. RKD Group’s omnichannel approach leverages technology, advanced data science and award-winning strategic and creative leadership to accelerate net revenue growth, build long-term donor relationships and drive online and offline engagements and donations. With a growing team of professionals, RKD Group creates breakthroughs never thought possible. [Follow me on Twitter](https://twitter.com/RKDGroup) #### Leave a comment: Previous ##### [Q&A: Is asking for planned giving ethical during a pandemic?](https://blog.rkdgroup.com/qa-is-asking-for-planned-giving-ethical-during-a-pandemic-3) Next Post ##### [Using AI to lead digital media audience segmentation](https://blog.rkdgroup.com/using-ai-to-lead-digital-media-audience-segmentation) ### Search GroupThinkers ![](https://cdn2.hubspot.net/hubfs/459002/Assets%20Apr/magnifying-glass.png) [![GP FG - Blog Rail 340x340](https://blog.rkdgroup.com/hs-fs/hubfs/GP%20FG%20-%20Blog%20Rail%20%20340x340.png?width=340&name=GP%20FG%20-%20Blog%20Rail%20%20340x340.png "GP FG - Blog Rail 340x340")](https://info.rkdgroup.com/givingpulse-field-guide-q1-2024-access) [![MidYear Benchmarks-Sidebar_SolidGold](https://blog.rkdgroup.com/hs-fs/hubfs/MidYear%20Benchmarks-Sidebar_SolidGold.png?width=340&name=MidYear%20Benchmarks-Sidebar_SolidGold.png "MidYear Benchmarks-Sidebar_SolidGold")](https://info.rkdgroup.com/donor-trust-access) - Latest Posts - Popular Posts [What happens when a 'long shot' becomes the leader? | Susan Blouch, Lebanon Rescue Mission](https://blog.rkdgroup.com/what-happens-when-a-long-shot-becomes-the-leader-susan-blouch-lebanon-rescue-mission) [ Podcast](https://blog.rkdgroup.com/topic/podcast) [ Missions](https://blog.rkdgroup.com/topic/missions) [Rossi's Roundup: The fundraising landscape is shifting. Are you ready?](https://blog.rkdgroup.com/rossis-roundup-the-fundraising-landscape-is-shifting.-are-you-ready) [ Nonprofit Industry](https://blog.rkdgroup.com/topic/nonprofit-industry) [RKD Group Acquires Whiteboard](https://blog.rkdgroup.com/rkd-group-acquires-whiteboard) [ Digital Fundraising](https://blog.rkdgroup.com/topic/digital-fundraising) [ Direct Mail Fundraising](https://blog.rkdgroup.com/topic/direct-mail-fundraising) [ Multichannel](https://blog.rkdgroup.com/topic/multichannel) [ Fundraising](https://blog.rkdgroup.com/topic/fundraising) [ Nonprofit Industry](https://blog.rkdgroup.com/topic/nonprofit-industry) [ RKD](https://blog.rkdgroup.com/topic/rkd) [ Brand](https://blog.rkdgroup.com/topic/brand) ### Categories - [Digital Fundraising (180)](https://blog.rkdgroup.com/tag/digital-fundraising) - [Podcast (136)](https://blog.rkdgroup.com/tag/podcast) - [Nonprofit Industry (126)](https://blog.rkdgroup.com/tag/nonprofit-industry) - [Data & Analytics (91)](https://blog.rkdgroup.com/tag/data-analytics) - [Digital Media (69)](https://blog.rkdgroup.com/tag/digital-media) - [Fundraising (55)](https://blog.rkdgroup.com/tag/fundraising) - [Trends (47)](https://blog.rkdgroup.com/tag/trends) - [COVID-19 (42)](https://blog.rkdgroup.com/tag/covid-19) - [Multichannel (41)](https://blog.rkdgroup.com/tag/multichannel) - [Food Banks (39)](https://blog.rkdgroup.com/tag/food-banks) - [Animal Care (37)](https://blog.rkdgroup.com/tag/animal-care) - [Donor Retention (36)](https://blog.rkdgroup.com/tag/donor-retention) - [Mid-Major Donors (35)](https://blog.rkdgroup.com/tag/mid-major-donors) - [Strategy (35)](https://blog.rkdgroup.com/tag/strategy) - [Direct Mail Fundraising (34)](https://blog.rkdgroup.com/tag/direct-mail-fundraising) - [Missions (32)](https://blog.rkdgroup.com/tag/missions) - [Stewardship (31)](https://blog.rkdgroup.com/tag/stewardship) - [Creative (29)](https://blog.rkdgroup.com/tag/creative) - [Leadership (24)](https://blog.rkdgroup.com/tag/leadership) - [Sustainer Donors (20)](https://blog.rkdgroup.com/tag/sustainer-donors) - [Year-End Giving (19)](https://blog.rkdgroup.com/tag/year-end-giving) - [Acquisition (18)](https://blog.rkdgroup.com/tag/acquisition) - [Social Media (18)](https://blog.rkdgroup.com/tag/social-media) - [Cultivation (17)](https://blog.rkdgroup.com/tag/cultivation) - [Email (16)](https://blog.rkdgroup.com/tag/email) - [Google Grant (15)](https://blog.rkdgroup.com/tag/google-grant) - [Optimization (15)](https://blog.rkdgroup.com/tag/optimization) - [SEO (15)](https://blog.rkdgroup.com/tag/seo) - [Data Privacy (14)](https://blog.rkdgroup.com/tag/data-privacy) - [Technology (14)](https://blog.rkdgroup.com/tag/technology) - [Giving Tuesday (13)](https://blog.rkdgroup.com/tag/giving-tuesday) - [Humanitarian Action (13)](https://blog.rkdgroup.com/tag/humanitarian-action) - [Events (12)](https://blog.rkdgroup.com/tag/events) - [Donation Pages (11)](https://blog.rkdgroup.com/tag/donation-pages) - [Health & Hospitals (11)](https://blog.rkdgroup.com/tag/health-hospitals) - [Conversion (10)](https://blog.rkdgroup.com/tag/conversion) - [Brand (9)](https://blog.rkdgroup.com/tag/brand) - [Donor Lifecycle (9)](https://blog.rkdgroup.com/tag/donor-lifecycle) - [Donor-Advised Funds (9)](https://blog.rkdgroup.com/tag/donor-advised-funds) - [Management (8)](https://blog.rkdgroup.com/tag/management) - [RKD (8)](https://blog.rkdgroup.com/tag/rkd) - [Audience-First (6)](https://blog.rkdgroup.com/tag/audience-first) - [Facebook (6)](https://blog.rkdgroup.com/tag/facebook) - [The Salvation Army (6)](https://blog.rkdgroup.com/tag/the-salvation-army) - [GDPR (4)](https://blog.rkdgroup.com/tag/gdpr) - [User Experience (4)](https://blog.rkdgroup.com/tag/user-experience) - [Conferences (3)](https://blog.rkdgroup.com/tag/conferences) - [Election (3)](https://blog.rkdgroup.com/tag/election) - [Postal Service (3)](https://blog.rkdgroup.com/tag/postal-service) - [Attribution (2)](https://blog.rkdgroup.com/tag/attribution) - [Capital Campaigns (2)](https://blog.rkdgroup.com/tag/capital-campaigns) - [Gift Catalog (2)](https://blog.rkdgroup.com/tag/gift-catalog) - [Ministries (2)](https://blog.rkdgroup.com/tag/ministries) - [Mobile (2)](https://blog.rkdgroup.com/tag/mobile) - [CRM (1)](https://blog.rkdgroup.com/tag/crm) - [Corporate giving (1)](https://blog.rkdgroup.com/tag/corporate-giving) - [DRTV (1)](https://blog.rkdgroup.com/tag/drtv) - [Planned Giving (1)](https://blog.rkdgroup.com/tag/planned-giving) see all [![Gen X eBook download](https://blog.rkdgroup.com/hs-fs/hubfs/Gen%20X%20eBook%20download.jpg?width=360&name=Gen%20X%20eBook%20download.jpg "Gen X eBook download")](https://info.rkdgroup.com/en/the-nonprofit-marketers-guide-to-generation-x) ### Read More of What You Like ## [2026 digital predictions: The year complexity becomes the strategy](https://blog.rkdgroup.com/2026-nonprofit-digital-predictions) ## [How to prepare your nonprofit for PCI compliance](https://blog.rkdgroup.com/how-to-prepare-your-nonprofit-for-pci-compliance) ## [What nonprofits should know about Canadian data privacy laws](https://blog.rkdgroup.com/what-nonprofits-should-know-about-canadian-data-privacy-laws) ![Rkdgroup](https://blog.rkdgroup.com/hubfs/Rkdgroup%20Sep%202017/Images/footer_logo.png "Rkdgroup") - [Solutions](https://rkdgroup.com/services/) - [Work](https://rkdgroup.com/work/) - [About Us](https://rkdgroup.com/about-us/) - [Blog](https://blog.rkdgroup.com/) - [Contact](https://rkdgroup.com/contact/) [Contact](https://rkdgroup.com/contact) - - - RKD Group is a leading fundraising and marketing provider to hundreds of nonprofit organizations. We have a team of experts with deep skill sets in direct response marketing. [connect@rkdgroup.com](mailto:connect@rkdgroup.com) [1 800 222 6070](tel:1-800-222-6070) [Privacy policy](https://rkdgroup.com/privacy-policy) - - - ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "RKD Group", "url" : "https://blog.rkdgroup.com/author/rkd-group" }, "dateModified" : "2021-12-29T20:37:58.415Z", "datePublished" : "2020-07-30T22:00:36.000Z", "headline" : "Blackbaud ransomware attack: How nonprofits should respond", "image" : [ "https://blog.rkdgroup.com/hubfs/210108-RKD-Blackbaud-ransomware-attack-How-nonprofits-should-respond-Doodle-v2.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.rkdgroup.com/blackbaud-ransomware-attack-how-nonprofits-should-respond", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.rkdgroup.com/hubfs/RKD-logo-red-tm%20(1).png" }, "name" : "RKD Group" } } ```