UNIVERSITIES and charities across the UK, US and Canada - including in the North-East - have had data stolen after a cloud computing provider was hacked earlier this year.

Targeting Blackbaud, one of the world's largest education administration, fundraising, and financial management software providers, hackers were able to access data about students and alumni at Newcastle and Durham universities. 

Among others affected in the hack, which happened in May, were Human Rights Watch, National Trust and the children's mental health charity Young Minds.

Garry Brown, managing director of Darlington-based Bondgate IT, said: “This is a prime example of how a cyber-attack on global cloud computing provider Blackbaud, located 4,500 miles away in Colorado in the United States, can have far-reaching effects on charities and organisations operating right here in the North-East.

“This data breach would have been caused by a relatively simple phishing attack, in which an employee clicked on a rogue link within an email, allowing a cybercriminal inside Blackbaud’s system.

“As a result, at least 125 charities and organisations using its services – including the University of Newcastle, the University of York, the National Trust, and Sue Ryder, have issued data breach alerts.

“It is vital businesses and organisations in the North-East and North Yorkshire take heed to address any gaps in IT security and ensure they have advanced malware protection.”

Hackers removed a copy of data before being locked out by US-based Blackbaud, which says no personal information, such as credit card or bank account details, was accessed.

The cloud computing provider paid the hacker's ransom on the promise that stolen data would be deleted. 

Both Newcastle University and Durham University were notified on July 16 about the ransomware attack, which Blackcaud believes was carried out between February and May 2020.

In a statement on its website, Newcastle University said: "During this attack, a sub-set of data belonging to a number of organisations, including Newcastle University and other UK universities, was copied.

"We have been advised that no bank details, credit card or password details were taken, the data accessed relates to names and contact details for alumni, donors, and other stakeholders.

"We have been assured that no card or bank details were involved in the breach, but details of donation dates and amounts given are recorded on the platform."

Durham University also notified its alumni and confirmed no encrypted data was accessed.

On its website, Blackbaud said: "Prior to our locking the cybercriminal out, the cybercriminal removed a copy of a subset of data from our self-hosted environment.

"The cybercriminal did not access credit card information, bank account information, or social security numbers.

"Because protecting our customers’ data is our top priority, we paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed.

"Based on the nature of the incident, our research, and third party (including law enforcement) investigation, we have no reason to believe that any data went beyond the cybercriminal, was or will be misused."

  • Have you beed notified that your data was breached? Get in touch at newsdesk@nne.co.uk