The company said it prevented the intruder from accessing full system and completely encrypting files. Blackbaud said the attacker accessed, “a copy of a subset of data from our self-hosted environment.”

According to its statement, “The cybercriminal did not access credit card information, bank account information or Social Security numbers.” Blackbaud also said, it “paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed.” 

The company contact affected customers and provided them with what it called additional information and resources. Blackbaud said the attack did not involve applications in its public cloud environment, “nor did it involve the majority of our self-hosted environment. “The said it follows security best practices, but it has implemented changes to prevent the specific threat from happening again.”