Cloud provider stopped ransomware attack but paid ransom

Blackbaud, a software and cloud hosting solution provider, said it had stopped a ransomware attack that tried to encrypt the company's files but was forced to pay a ransom after hackers stole data from the company's network and threatened to publish it online.

The incident happened in May 2020, according to a company announcement on Thursday.

Blackbaud said the hackers broke into its network and tried to install ransomware to block the company's customers from accessing their data and servers.

"After the discovery of the attack, our cyber security team - together with independent experts - successfully prevented the cyber criminal from acquiring access in our system and fully encrypt them archives "and finally expelled them from our system," said the company.

However, Blackbaud says that before moving away from their network, hackers managed to steal a subset of data from the "environment" where customers store their data. archives their.

The ransomware gang then threatened to release the stolen items data, unless Blackbaud pays the ransom - even if their initial attack file encryption stopped.

"Because the protection of our customers' data is our first priority, we paid the ransom by receiving a confirmation that the copies of the data they were destroyed, "said Blackbaud.

"Based on the nature of the incident, our investigation and the third party investigation, we have no reason to believe that any data has been used or will be disseminated or otherwise made public," the company added.

The cloud provider, which works primarily with nonprofits, educational institutions and the healthcare sector, said the incident only affected the data of a small subset of its customers, who of course have been informed of the incident.