The Athenian School

Athenian School reported a ransomware attack on third-party vendor Blackbaud occurring between Feb 7 and May 20, 2020. The attack resulted in the exfiltration of unencrypted personal information, including Social Security Numbers and names, from a backup file. Blackbaud paid a ransom and claimed to have destroyed the data, but Athenian issued notifications to affected individuals offering 24 months of credit monitoring and identity theft protection. Remediation includes encrypting SSN data and restricting storage of sensitive vendor data.