Leading National Behavioral Healthcare Provider

Call 1-800-345-1292

  • Carl E. Clark II
  • COVID-19
  • PPE for Devereux
  • Carl E. Clark II
  • Yolanda Graham
  • Leah Yaw

Tweet Share on LinkedIn Send email Print

Notice of Blackbaud Data Event

On Thursday, July 16, 2020, Blackbaud, Inc., a cloud computing provider that offers customer relationship management tools to nonprofit organizations, reported that, in May 2020, it experienced a ransomware incident that resulted in encryption of certain Blackbaud systems. Following its investigation, Blackbaud notified its customers, including Devereux Advanced Behavioral Health, that an unknown cybercriminal may have accessed or acquired certain Blackbaud customer data. Blackbaud reported that the data was stolen by the cybercriminal at some point before Blackbaud locked the cybercriminal out of the environment on May 20, 2020.

Upon learning of the Blackbaud incident, Devereux immediately launched an investigation to determine what, if any, sensitive Devereux data was potentially involved. This investigation included working diligently to gather further information from Blackbaud to understand the scope of the incident. To date, Devereux has not received any reports that personal information has been misused as a result of this incident.

What Information Was Involved?

Devereux’s investigation determined that the impacted Blackbaud systems hosted its donor database. In the profile of certain actual or potential Devereux donors, there was a tab that listed the relevant donor’s relationship to an individual served by Devereux, thereby identifying that individual as having been served by Devereux currently or in the past. The impacted information did not contain the Social Security Numbers, financial account information, payment card information, or driver’s license numbers of Devereux’s clients or constituents. Please note that, to date, we have not received any information from Blackbaud that Devereux information was specifically accessed or acquired by the cybercriminal, but this possibility could not be ruled out. Devereux is unaware of any instances of identity theft or fraud as a result of this incident, but it is making individuals whose information resided in the affected database aware of this incident.

What We Are Doing …

The confidentiality, privacy and security of our donors’ and our clients’ information is of the utmost importance, and we take this incident very seriously. As part of its ongoing commitment to secure its donors’ and individuals’ confidential information, Devereux is working to review its existing policies and procedures regarding third-party vendors, and is working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future. Devereux will also be notifying federal and state regulators, as required. In addition, while it is unaware of any actual or attempted misuse of its information, in an abundance of caution, Devereux is notifying potentially impacted individuals so they may take further steps to protect their information, should they feel it appropriate to do so. Donors whose record in Devereux’s donor database was impacted will receive a direct notice via U.S. Postal Service mail.

What Can Impacted Individuals Do?

Devereux has established a dedicated assistance line for individuals seeking additional information regarding this incident. If you have additional inquiries, please call our dedicated assistance line at (855) 896.4452 between the hours of 9 a.m.–11 p.m. (ET), Monday through Friday, and 11 a.m.–8 p.m. (ET) on Saturdays and Sundays (excluding holidays). Potentially affected individuals may also email Devereux Advanced Behavioral Health at: ITIncident@devereux.org. Individuals may also consider the information and resources outlined below.

Monitor Your Accounts

Devereux encourages you to remain vigilant against incidents of identity theft and fraud, promptly change any involved account passwords, to review your account statements, and to monitor your credit reports for suspicious activity. Under U.S. law, you are entitled to one free credit report annually from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report.

You have the right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a security freeze on your credit report. Should you wish to place a security freeze, please contact the major consumer reporting agencies listed below:

Experian
P.O. Box 9554
Allen, TX 75013
1-888-397-3742
  
TransUnion
P.O. Box 2000
Chester, PA 19016
1-888-909-8872
  
Equifax
P.O. Box 105788
Atlanta, GA 30348-5788
1-800-685-1111
  

In order to request a security freeze, you will need to provide the following information:

  1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
  2. Social Security Number;
  3. Date of birth;
  4. If you have moved in the past five years, provide the addresses where you lived over the prior five years;
  5. Proof of current address, such as a current utility bill or telephone bill;
  6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.); and
  7. If an individual is a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.

As an alternative to a security freeze, you have the right to place an initial or extended “fraud alert” on your file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the agencies listed below:

Experian
P.O. Box 2002
Allen, TX 75013
1-888-397-3742 
TransUnion
P.O. Box 2000
Chester, PA 19016
1-800-680-7289 
Equifax
P.O. Box 105069
Atlanta, GA 30348
1-888-766-0008 

Additional Information

You can further educate yourself regarding identity theft, fraud alerts, security freezes, and the steps you can take to protect yourself, by contacting the consumer reporting agencies, the Federal Trade Commission, or your state Attorney General.

The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); or TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. You have the right to file a police report if you ever experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and your state Attorney General. This notice has not been delayed by law enforcement.