P2022-ND-048

The Organization is a post-secondary educational institute in Vermont, United States of Amercia. Blackbaud Inc. (Blackbaud) provided cloud-based data management services to the Organization. On July 16, 2020, Norwich was notified by Blackbaud that it had discovered and stopped a ransomware attack that occurred in May 2020. Blackbaud experienced a ransomware attack that occurred between February 7, 2020 and May 20, 2020. Blackbaud systems affected by the attack included a database containing certain data related to the Organization. Blackbaud informed the Organization that it paid a demand to the attacker and obtained confirmation that the compromised information had been destroyed and is no longer in the possession of the attacker(s). The Organization reported, “Due to the complex nature of the data provided by Blackbaud, this process took significant time.”