Blackbaud Inc., the Daniel Island company that makes fundraising and management software for nonprofits, schools and other organizations, said it paid a cybercriminal who copied some of its customers’ data during a ransomware attack this spring.

The company disclosed the attack Thursday in a statement on its website.

“In May of 2020, we discovered and stopped a ransomware attack,” Blackbaud said. Its cybersecurity team, working with independent forensics experts and law enforcement, kept the attacker from blocking the company’s access to its systems and from fully encrypting files, and ultimately expelled the intruder, the company said.

But before Blackbaud locked the cybercriminal out, the attacker “removed a copy of a subset of data from our self-hosted environment,” the company said.

What was taken, and what was paid

Blackbaud said the attacker did not access credit card information, bank account information or Social Security numbers.

“Because protecting our customers’ data is our top priority, we paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed,” the company said.

Based on the nature of the incident, its own research and investigations by third parties, including law enforcement, Blackbaud said it has “no reason to believe that any data went beyond the cybercriminal, was or will be misused; or will be disseminated or otherwise made available publicly.”

The statement did not say how much Blackbaud paid, how many customers were affected or what kinds of records the attacker copied.

The incident did not involve the company’s public cloud environment, which runs on Microsoft Azure and Amazon Web Services, or most of its self-hosted environment, Blackbaud said. It said the subset of customers involved had been notified and given more information and resources.

“We apologize that this happened and will continue to do our very best to supply help and support as we and our customers jointly navigate this cybercrime incident,” the company said.

A company that sells trust

Blackbaud said it fends off a constant stream of attacks. “Like many in our industry, Blackbaud encounters millions of attacks each month, and our expert Cybersecurity team successfully defends against those attacks,” the company said.

It said that over the last five years it has built a substantial cybersecurity practice with a dedicated team, and that independent reviewers have found the program exceeds benchmarks for both the financial and technology sectors. The company belongs to groups including the Cloud Security Alliance and the Financial Services Information Sharing and Analysis Center.

“We believe the strength of our cybersecurity practice and advance planning is the reason we were able to shut down this sophisticated ransomware attack,” Blackbaud said. It said it has already made changes to prevent this specific issue from happening again.

Holding donor data is central to Blackbaud’s business. In its annual report filed in February, the company told investors that despite its security measures, “we may still be vulnerable to a security breach, intrusion, loss or theft of confidential donor data and transaction data, which may harm our business, reputation and future financial results.”

The report said a compromise that resulted in customer or donor personal or payment card data being obtained by unauthorized people could hurt its reputation and finances and could lead to litigation or penalties.

One of Charleston’s biggest tech employers

Blackbaud had 3,611 employees worldwide at the end of 2019, according to its annual report. Its revenue last year was $900.4 million, up from $848.6 million in 2018.

The company said it had more than 45,000 customers in more than 100 countries at the end of 2019, including nonprofits, foundations, companies, schools and health care organizations. Its largest single customer accounted for less than 1% of its 2019 revenue. Outside the United States, it has operations primarily in the United Kingdom, Canada, Australia and Costa Rica, according to the report.

Blackbaud is headquartered on Fairchild Street on Daniel Island, in a four-story building it opened in 2018.