Save the Children Statement on Blackbaud Security Breach
What Happened
On July 16, Save the Children was notified of a cyberattack at one of our vendors, Blackbaud. Blackbaud provides software tools and management resources for nonprofits across the world, including Save the Children. We understand from Blackbaud that the incident began in February, when the hacker gained access to Blackbaud’s system, and continued until May 2020, when Blackbaud discovered the breach. At that time, Blackbaud worked with their own security teams, an external forensics firm and federal law enforcement to expel the attacker from their system. However, the hacker was still able to copy data from Blackbaud’s server. Blackbaud subsequently paid a ransom to the hacker to have them delete the data. Unfortunately, Save the Children was one of a number of organizations impacted by this security breach. Additional information on the incident is available on Blackbaud's website.
What Information Was Involved
Blackbaud’s system housed some of Save the Children’s supporter information, including names, contact information, details of their engagement with Save the Children such as event participation and giving history, as well as biographical details such as date of birth and more. However, not all of these details were present in every record. Credit card information and social security numbers were not impacted.
What We Are Doing
Save the Children places the highest level of regard on security and protecting our donor information. Since July 16, we have been in almost daily contact with Blackbaud to obtain more information about this incident. Although Blackbaud believes the risk to individuals whose data was stolen is very low, they have put in place dark web monitoring intended to detect trafficking of any of the copied data.
Our supporters trust us with their information, and we do not take this lightly. We have removed our data off Blackbaud's servers, and we will continue to take steps to protect supporters’ information, both internally and with all of our third-party vendors, in our combined efforts to ensure every child gets the future they deserve.
Save the Children continues to assess this incident and the data involved, and we may share additional information as we learn more.
Save the Children believes every child deserves a future. Since our founding more than 100 years ago, we've been advocating for the rights of children worldwide. In the United States and around the world, we give children a healthy start in life, the opportunity to learn and protection from harm. We do whatever it takes for children – every day and in times of crisis – transforming the future we share. Our results, financial statements and charity ratings reaffirm that Save the Children is a charity you can trust. Follow us on Facebook, Instagram, Twitter and YouTube.