Notice of Data Security Incident

January 21, 2021 – Paraquad is providing notice of a recent data security event that occurred at Paraquad’s third-party fundraising technology platform provider, Blackbaud, Inc.

In May 2020, Blackbaud reported to law enforcement that it experienced a ransomware incident that resulted in encryption of certain Blackbaud systems. Blackbaud locked the threat actor out of the environment on May 20, 2020, and further began working with forensic investigators to determine the nature and scope of the incident.

Following its investigation, Blackbaud notified its customers that, indeed, an unknown actor may have accessed or acquired certain Blackbaud customer data. On July 16, Paraquad received notification from Blackbaud regarding this event. Upon notice, Paraquad immediately began an investigation to better understand the nature and scope of the incident and any impact on Paraquad’s data. The investigation included a time-intensive and detailed manual analysis of Parquad’s donor base, which includes Paraquad participants, to determine what, if any, sensitive Paraquad data was potentially involved. We worked diligently to gather further information from Blackbaud to understand the scope of the incident.

Paraquad understands from Blackbaud that a backup file at Blackbaud was accessed, which may have included names; contact information, such as addresses, phone numbers, and emails; and a history of donor relationships with our organization. Please note that, to date, we have not received confirmation from Blackbaud that individuals’ specific information was accessed or acquired by the unknown actor. Also, Blackbaud has stated that encrypted credit card information and banking information were not accessed by the cybercriminal.

The security and privacy of our supporters and stakeholders is of the utmost importance to Paraquad. As part of our ongoing commitment to the security of information in our care, Paraquad is working to review our existing policies and procedures regarding our third-party vendors, and is working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future. Paraquad will also be notifying regulators, as required.

We encourage potentially impacted individuals to review the below Steps You Can Take to Help Protect Your Information. There individuals will find general information on what you can do to help protect their personal information.

We apologize for this incident and regret any inconvenience caused. Should you have any further questions or concerns regarding this matter, please call our dedicated assistance line at 1-855-526-1149, Monday through Friday, between the hours of 8:00 a.m. and 5:30 p.m. Central Time. You may also email Kevin Condon, Senior Director of Development and Marketing at Paraquad: kcondon@paraquad.org.

All of us at Paraquad value your support, which increases independence for people with disabilities in our community every day. Thank you very much.

Steps You Can Take to Help Protect Your Information

Monitor Your Accounts/Credit Reports

We encourage you to remain vigilant against incidents of identity theft and fraud and to review account statements, credit reports, and explanation of benefits forms for suspicious activity and report any suspicious activity immediately to your insurance company, health care provider, or financial institution. Under U.S. law you are entitled to one free credit report annually from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report.

You have the right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a security freeze on your credit report. Should you wish to place a security freeze, please contact the major consumer reporting agencies listed below:

Experian
P.O. Box 9554
Allen, TX 75013
1-888-397-3742
www.experian.com/freeze/center.html

TransUnion
P.O. Box 160
Woodlyn, PA 19094
1-888-909-8872
www.transunion.com/credit-freeze

Equifax
P.O. Box 105788
Atlanta, GA 30348-5788
1-800-685-1111
www.equifax.com/personal/credit-report-services

In order to request a security freeze, you will need to provide the following information:

  1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
  2. Social Security number;
  3. Date of birth;
  4. If you have moved in the past five (5) years, the addresses where you have lived over the prior five years;
  5. Proof of current address, such as a current utility bill or telephone bill;
  6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.);
  7. If you are a victim of identity theft, a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.

As an alternative to a security freeze, you have the right to place an initial or extended “fraud alert” on your file at no cost.  An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years.  Should you wish to place a fraud alert, please contact any one of the agencies listed below:

Experian
P.O. Box 9554
Allen, TX 75013
1-888-397-3742
www.experian.com/fraud/center.html

TransUnion
P.O. Box 2000
Chester, PA 19016
1-800-680-7289
www.transunion.com/fraud-victim-resource/place-fraud-alert

Equifax
P.O. Box 105069
Atlanta, GA 30348
1-888-766-0008
www.equifax.com/personal/credit-report-services

Additional Information

You can further educate yourself regarding identity theft, fraud alerts, security freezes, and the steps you can take to protect yourself by contacting the consumer reporting agencies, the Federal Trade Commission, or your state Attorney General.

The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, www.identitytheft.gov, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. You have the right to file a police report if you ever experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and your state Attorney General. This notice has not been delayed by law enforcement.