Oh $%&@ - RE Data compromised

Thanks for researching that, Stacey. 

Stacey Brake‍  - we're not obliged to send out notifications but I did do my research in case.  Be sure you're checking on the requirements of your state, as well as the state of each of your donors, as they may be different.  If the data breached had required notification, we (in TX and it's a fairly lenient state) would have been required to send hard copy notices to all donors, even if we had emails available.  We could only send emails if no physical address was available.  Plus we would have had to report to the appropriate office within Texas about the fraud, and print notices of the fraud in local papers of our largest cities with constituents - all if we had more than a certain number of donors within Texas.  Only if a calculation of costs, or number of donors, reached a certain threshold set by the State of Texas, would we have been allowed to forego the hard copy mailing and send only an email. 

   However, remember that you have to follow the rules of the state in which your donor resides, so if you have donors in other states, you need to be sure you're following their regulations as well.  Most of these are fairly consistent with CA being the most stringent of all within the US.  The same threshold rules in the above paragraph would apply from state to state if you have large numbers of donors within multiple states.  Many educational institutions fit this model due to their alumni networks.

   If you have donors outside the US, then those rules are even more stringent and may require notification of that donor(s) even if it wasn't required within the US.

Stacey Brake‍  - use the Toolkit sent by Blackbaud in the original email that gives links for every state's laws.  Sorry to say, you need to read like a lawyer through all this legal code so get some help if you don't have the background for it.  We also consulted with our Tech Services Support who is certified in cybersecurity and was able to give general guidelines such as - you must notify donors according to the state/locale laws within which they live and not just according to the state where you are based.  


We were blessed not to have any credit card, SSN, or any other personal information saved other than address, email, phone and donations - none of these raised to the level of Secure Personal Information by the legal definition of CA (most stringent) or TX (our location) law which we used as our litmus tests.  You need to know what you store in the unencrypted data fields of your breached databases.  If any of the Secure Personal Information, and usually it is two-pieces of information in conjunction that rise to the level of Secure PI, has been breached, then you are bound by law to notify your constituents that were included in the breach, what potential information was breached, and at what time.  For many educational and health institutions, their saved information falls into these areas, especially due to HIPAA laws.


I hope this is helpful.


Meg

Another question came up here - what about other fields where someone * might * have placed SSN or Credit Card number not in the correct location?  Is there a way to scan data across the database to see if those type of numbers are stored in unexpected places such as notes?  Is there a 3rd party software to do such a scan?

Debbie Kelly‍ and JoAnn Strommen‍ take a look at https://www.spirion.com/.  Using a backup of your database they can scan media attachments as well as Constituent Notes, Action Notes, Gift Notes, etc. for key phrases, words, number format strings, etc..  Searches could be done both for common HIPAA related terms as well as PII and financial related info.


Having managed databases for over 20 years I'd strongly encourage folks to take a look at their action notes, gift notes, gift reference field, constituent notes, and all attachments because I guarantee you there is stuff in there that shouldn't be. I've yet to meet a database that didn't have *something* in those places that shouldn't be there.

Linda:  How did you get that notification regarding YOUR organization's bank account info in FE NXT? Was it in response to direct questions you were asking Blackbaud? or was it a direct outreach from Blackbaud to you? We have FENXT and did not get that notification/update.