Western is among at least a dozen institutions impacted by an international data breach, targeting information from universities across Canada, the United Kingdom and United States.
The data was breached by a ransomware attack against a third-party company, Blackbaud –– an industry-leading business that manages Western University’s “alumni, donor and organization data, and to communicate with various members of the community.”
Students, staff and alumni received emails from Western on Friday informing them of the attack. The breached data may include the names, birthdays and contact information of university community members and alumni — no financial information, such as banking or credit card information, was impacted.
Blackbaud has assured Western their data has been retrieved.
“Blackbaud informed Western that a ransom was paid by Blackbaud,” reads the email. “The cybercriminal confirmed copies removed were destroyed, and that research by Blackbaud and third-party investigations (including law enforcement) shows no evidence that the data has been shared by the cybercriminal.”
The university has launched an investigation into the attack and is indefinitely suspending their use of Blackbaud. The company released a statement on their website, saying they have also launched an investigation after discovering the breach in May.
Hackers use ransomware attacks to steal and encrypt a company’s data, holding it hostage until the company pays a ransom to retrieve it.
“Because protecting our customers’ data is our top priority, we paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed,” the statement from Blackbaud reads.
Students' data was also implicated last school year, when medical testing company LifeLabs suffered a major ransomware attack in October that affected around 15 million Canadians.
In their email, Western said those whose information was compromised in the breach will be contacted directly, but suggests that staff, students and alumni report any suspicious activity or suspected identity theft to law enforcement.