Statement: Notice of Blackbaud data breach

CARE Canada has recently learned that Blackbaud, a third-party platform we use for customer relationship management (CRM), experienced a security breach in May 2020. As one of the world's largest CRM providers, this cyber attack has affected many of Blackbaud's clients around the world and we now know this breach included data about CARE Canada supporters.

It is important to note that Blackbaud has advised that the breach did not include sensitive financial information, such as credit card numbers and banking information, which were encrypted in Blackbaud’s database. We are working to confirm exactly which information about CARE Canada supporters was affected, but it appears that the incident affected information such as email and mail addresses, names and phone numbers, and in some cases date of birth.

Blackbaud has informed CARE Canada that a cybercriminal attempted to disrupt Blackbaud's operations with a ransomware attack intended to shut the company out of its own data and servers. After discovering the attack, Blackbaud worked with independent forensics experts and law enforcement to prevent the cybercriminal from blocking their system and were successful in expelling them. Prior to locking the cybercriminal out, the cybercriminal removed a copy of a subset of data.

Blackbaud paid the cybercriminal’s ransom demand and was told that the data copy they removed has been destroyed.

What Does This Mean For You

At this time Blackbaud has advised us that their investigations have not revealed evidence of further dissemination or public disclosure of this information. Forensic experts have been hired by Blackbaud to monitor for any reappearance of the data, and we are continuing to communicate with Blackbaud to understand and address the impact of this incident on our supporters.

We are contacting you so are aware and can monitor and report any suspicious activity. We recommend that you remain vigilant against "phishing" attempts by third parties where the sender refers to your relationship with CARE Canada. We will never ask you to share personal information via web or email.

In addition, there are further steps which you can take to protect yourself:

1. Place a Fraud Alert: Place a fraud alert on your credit file. The alert will tell creditors to contact you before they open any new accounts or change your existing accounts. You can place this alert by contacting either or both of the two Canadian consumer credit bureaus listed below.

2. You can also place a "Credit Freeze:" A "credit freeze" on your credit file states that no credit reports can be released without your approval. Please contact the two national consumer credit bureaus above for more information. All bureaus charge a fee for this service.

3. Periodically Request a Credit Report: Whether or not your data has been compromised, we further recommend that you periodically check your credit reports. Checking your credit reports from the above identified credit bureaus can help you identify problems and address them quickly. You may obtain a copy of your credit report, free of charge, whether or not you suspect any unauthorized activity on your account.

4. Report suspicious activity: If you find suspicious activity on your credit reports or have reason to believe your information is being misused, please contact your local law enforcement and the credit bureaus immediately to file a report. While speaking with law enforcement, remember to get a copy of the police report; some creditors may ask for the information it contains to absolve you of fraudulent debts. It is also advisable that you contact your bank, credit card companies and appropriate government departments to inform them of this personal information advisory.

5. Continue to monitor your credit reports: Even with a fraud alert on your account, you should continue to monitor your credit reports to ensure that an imposter has not opened an account with your personal information.

6. Learn more:

  • The Royal Canadian Mounted Police has an identity theft resource site available here
  • The Canadian Federal Government provides protection advice at www.getcybersafe.ca

What We Are Doing

While CARE Canada’s investigation into this incident is continuing, we are immediately notifying you so that you can take action to protect yourself.

The ongoing safeguarding of your information is a top CARE Canada priority. We know that cybercrime is a sophisticated and growing threat to all companies and sectors, and have increased our focus on cybersecurity accordingly.

We are working with Blackbaud to understand the circumstances of the breach and what measures are being put in place to prevent future incidents.

This incident did not affect any CARE Canada technology systems or infrastructure and we have protocols in place to maintain protection over our internal systems and platforms.

We very much regret this incident and understand that you may have concerns. As we learn more, we will keep you apprised of any updates and we are here to answer any questions you might have at info@care.ca or 1-800-267-5232.

-30-

CARE has spokespeople available. For media inquiries, please contact:

Lama Alsafi
media@care.ca | 613-228-5641


About CARE Canada:

Founded in 1945 with the creation of the CARE Package®, CARE develops solutions alongside women and girls in developing countries to lift themselves, their families, and their communities out of poverty and out of crisis. CARE stands with women and girls around the world in economic empowerment. We bring women, girls, and their communities together to challenge inequality while facing issues like food insecurity, climate change, and emergency relief in times of crisis or disaster. CARE works in 100 countries around the world.

To learn more about CARE Canada, visit www.care.ca