Cyberattack on Blackbaud

Recently, TU Delft has been notified of a data security incident which included a TU Delft alumni database from 2017. This notification came from Blackbaud, a third-party service provider and one of the world’s largest providers of customer relationship management systems for non-profit organisations and the higher education sector. 

On 16 July 2020, Blackbaud, the provider of TU Delft’s alumni relationship management system, informed us that they had been the victim of a ransomware attack between 7 February and 20 May 2020. As noted in Blackbaud’s public disclosure, the cybercriminal was able to remove a copy of a subset of data from a number of their clients. This included an old back-up file of February 2017 with alumni data from Delft University of Technology. 

What information does it involve?

The data accessed by the cybercriminal may have contained some of the following information: 

• Basic details e.g. name, title, gender, date of birth and alumni ID (if applicable)
• Addresses (home address) and contact details e.g. phone and/or e-mail
• Study information e.g. faculty, programme, dates attended
• Employment information e.g. company name and job title

The file did not contain bank accounts, passwords or Citizen Service Numbers (BSN).While Blackbaud assures us that the incident was solved and the back-up file was deleted by the hackers, we immediately launched our own investigation. This breach did not happen at a TU Delft facility and given the number of other institutions affected, we do not believe that this attack was specifically targeting TU Delft or our alumni database.

What are we doing

In the response to the incident and the follow-up steps to be taken, we are co-operating with other Dutch universities that have been affected, including Utrecht University.

• We have informed the Dutch Data Protection Authority of the breach.
• As soon as we got the information needed, the provision of which took almost three weeks, we notified alumni to make them aware of this breach of Blackbaud’s systems and can remain vigilant about any attempted misuse of data.  
• We are working with Blackbaud to understand why there was a delay between them finding the breach and notifying us, as well as what actions they have taken to increase their security.
• We are working with Blackbaud to understand why there was still an old back-up available on their own self-hosted environment.
• We are reviewing our internal practices and continue to take advice from our Data Protection and IT security teams to ensure the greatest level of data protection moving forward.
• We are reviewing our collaboration with Blackbaud.

What can you do?

The affected alumni have received a message from us via e-mail of postal mail (latest end of August). Alumni who are unsure whether their details were in the file, and who have not yet received a message at the postal or e-mail address known to us, can reach us via alumnirelations@tudelft.nl.

There is no need for contacts of TU Delft other than alumni to take action. Furthermore, alumni who graduated after 2017 are certainly not affected.

As a best practice, we recommend everyone remain vigilant and promptly report any suspicious activity (e.g. identify fraud)  to the proper law enforcement authorities.