Cybersecurity incident: no action required

Dear alumni and friends of Ohio University,

Out of an abundance of caution, we are writing to inform you of a cybersecurity incident involving a third-party computing company, Blackbaud, which the University uses for alumni and donor cloud data services. The incident, which occurred at a Blackbaud hosting center and not on any OHIO servers, did not involve your credit card information, bank account information or social security number. This message does not require any additional action from you.

Your privacy and security are important to us — accordingly, OHIO does not store credit card numbers, bank account information, or social security numbers in the system. University community member data that might have been accessed includes publicly available data such as contact information, demographic information, and your history with OHIO. Such information could be used in phishing attempts against you — emails designed to trick you into giving up information about yourself such as passwords and usernames. More information on phishing is available from the University’s Office of Information Technology.

Blackbaud informed us on July 17 that they had been targeted in a ransomware attack. We began investigating immediately to understand how our alumni, students and friends might have been affected. More information on the incident is available via Blackbaud.

Blackbaud informed the University, as well as the company’s many other nonprofit and education clients across the U.S. that were affected by this incident, that based on the company paying the demand, their research into the incident, and an independent outside investigation that included law enforcement, they have no reason to believe any data went beyond the cybercriminals; was or will be misused; or will be disseminated or otherwise made available publicly.

The University will continue to investigate this incident. While we have previously examined Blackbaud’s policies around cybersecurity and worked with them to institute protections, we will closely re-evaluate our relationship with the company to ensure it takes the necessary steps to address this incident and protect against future cyberattacks. We sincerely apologize this occurred through one of our vendors and regret any inconvenience it may cause you.

If you have questions, please contact adv-response@ohio.edu.

Vice President, University Advancement
President and CEO, The Ohio University Foundation