Dear Supporters of Lutheran Family Services Rocky Mountains,
LFSRM recently received notification from Blackbaud, one of our third-party service providers, about a data breach involving their data hosting system that may have involved LFSRM donor information.

Who Is Blackbaud?
Blackbaud is a leading international cloud software company. They provide cloud software, services, and data intelligence for nonprofits, foundations, corporations, educational institutions, and health care institutions. LFSRM maintains a vendor relationship with Blackbaud for the provision of financial and resource development software.

What Happened?
Blackbaud reports that they discovered an attempted ransomware attack to their system. Working with independent forensics experts and law enforcement, they were able to prevent the cybercriminal from blocking their system access and fully encrypting files, and ultimately expelling them from the Blackbaud system. Prior to this, the attacker did remove a backup file containing personal information.

LFSRM was not the only Blackbaud client affected by this, with other affected parties located throughout both North America and Europe. It is our understanding from Blackbaud that the information such as names, addresses and gift amounts may have been compromised as a part of this breach. Fortunately, we have confirmed that NO encrypted information such as credit card numbers, bank account numbers and passwords were accessed during this cyberattack. While Blackbaud was the target of this attack and the data breach occurred within their systems, LFSRM feels a deep responsibility and commitment to our supporters in notifying them of this security incident.

What is LFSRM Doing in Response to this Incident?
The LFSRM Director of Operations/Security Officer and Executive Team are monitoring Blackbaud’s response to this breach on an ongoing basis, including measures being taken by Blackbaud to ensure a repeat situation does not occur. LFSRM holds the safety of donor data as a top priority and appreciates the trust that supporters place in our agency to safeguard their information. We expect the same high standards of security from vendors that we use. Should we feel that Blackbaud is not responding adequately, either in the aftermath of this breach or going forward, or should there be a future incident, rest assured that LFSRM will be seeking an alternative vendor.

Please know that all of us at LFSRM greatly appreciate your generous support that is so critical to making our work possible. We are humbled by the faith that you have placed in us to carry out the ministry and mission of the agency, and accordingly, will always strive to honor that faith by protecting information that you share with us, now and in the future.
Should you have any questions or concerns, please do not hesitate to contact either Jane Pope Meehan, Vice President of Resource Development or myself.

James Horan Jane Pope Meehan
President & CEO Vice President – Resource Development