Dear Air Force Academy Family,
I am writing to notify you that in May of 2020, one of the Association of Graduates' third-party service providers, Blackbaud, Inc., discovered and stopped a ransomware attack on their servers that compromised some data of many of their clients, including the Association of Graduates. The cybercriminal attack on Blackbaud did not access credit card information, bank account information, passwords or any other private financial data. Because protecting customers' data is their top priority, Blackbaud paid the cybercriminal's demands once the company received confirmation that the criminal destroyed the copy. Based on the nature of the incident, their research and third party (including law enforcement) investigation, there is currently no evidence that any data went beyond the cybercriminal. After internal evaluation of the issue we wanted to make you aware.
What kind of data did the attack involve?
The files accessed by the attack potentially contained the following:
- Names and birth dates
- Email and mailing addresses and phone numbers
- Giving histories and notes on your support.
The AOG does not ask for or store Social Security numbers, which means that data was not available to the cybercriminal. Additionally, Blackbaud encrypts all credit card information, which means that neither the cybercriminal nor the AOG can see the number itself.
What actions has Blackbaud taken to resolve this issue?
Blackbaud’s teams were able to quickly identify the vulnerability associated with this incident, including the tactics used by the cybercriminal, and took swift action to fix it. They were able to confirm through testing by multiple third parties, including the appropriate platform vendors, that the fix withstands all known current attack tactics. They are accelerating efforts to further strengthen their environment.
What actions can you take?
As a best practice, we recommend you remain vigilant and promptly report any potential suspicious activity or suspected identity theft to the proper law enforcement authorities.
For more information
You can read more about this incident on Blackbaud’s website. Should you have any further questions, please do not hesitate to contact me.
We stay committed to protecting your trust in us and continue to be thankful for your support of the Air Force Academy.
Sincerely,
