Dear Mount Washington Observatory Community Member,
I am writing to inform you about a breach at one of our cloud software vendors that involved information about you. Fortunately, the information did not include any personally identifiable information or “PII.” Thus, in the unlikely event that Mount Washington Observatory has your social security number, bank or financial account number, or governmental identification number, that information was not compromised in this incident. Nonetheless, since you and other members of our community trust us with information about yourselves, we feel that informing you about this event is the right thing to do.
The vendor breached is a widely used technology provider called Blackbaud. Like many other non-profits, Mount Washington Observatory uses certain Blackbaud cloud services to manage and retain fundraising information.
What Happened: We learned from Blackbaud on August 14, 2020 that it was the victim of a ransomware attack. Our communications with you are based on the information we obtained from Blackbaud, and that is otherwise available about this matter.
According to Blackbaud, although the cybercriminals were unsuccessful in their attempts to encrypt Blackbaud’s computer networks, they were able to export backup files for databases that Blackbaud maintains for its customers, including Mount Washington Observatory.
Blackbaud informed us that it engaged a team of forensic experts and law enforcement personnel to investigate and halt the malicious activity. Blackbaud and its team also negotiated with the cybercriminals and paid a ransom in exchange for assurances that the criminals had destroyed the information they had obtained from Blackbaud. Blackbaud also has assured us that it is monitoring the dark web to detect if the information is present there.
What Information Was Involved: As noted above, the information about you and other members of our community did not include PII. In other words, in the unlikely event that we even have your social security number, bank or financial account number, or governmental identification number, that information was not compromised. Our Blackbaud databases did contain your contact information, such as name, address, email, and phone number. While the information in the databases varies by individual, for some individuals the database may have also included information about gifts made to the Mount Washington Observatory.
What We Are Doing and You Can Do: Mount Washington Observatory has retained an information privacy and security attorney to ensure that Blackbaud has implemented appropriate protections to prevent this type of event from reoccurring, and to determine that Blackbaud otherwise has appropriate controls in place to safeguard the privacy and security of information about members of our community. Since the information at issue is both publicly available and not the type of information that typically results in identity theft, we feel that you do not need to take any particular action to protect yourself. However, we are happy to address any questions you have about this incident. To do so, please contact Stephanie Fitzgerald at response@mountwashington.org. Also, if you would like to contact Blackbaud directly, the toll free number to do so is 855-907-2099.
Mount Washington Observatory values the privacy and safety of our community members. We apologize for any concern the Blackbaud breach causes, and are here to answer any questions you have about it. Thank you for your support of the Observatory.
Sincerely,
Donna French Dunn Interim Executive Director
|