Notice of Blackbaud Event
Hospice & Palliative Care Buffalo, Inc. (“HPCB”) recently became aware of a data event by our third party service provider Blackbaud, Inc (“Blackbaud”), that may affect the privacy of information relating to certain former HPCB patients. On Thursday, July 16, 2020, we received notification from Blackbaud of a cyber incident. Blackbaud is a cloud computing provider that offers customer relationship management and financial services tools to organizations, including HPCB. Upon receiving notice of the cyber incident, we immediately commenced an investigation to better understand the nature and scope of the incident and any impact on HPCB data. This notice provides information about the Blackbaud incident, our response, and resources available to individuals to help protect information from possible misuse.
Blackbaud reported that, in May 2020, it experienced a ransomware incident that resulted in encryption of certain Blackbaud systems. Blackbaud reported the incident to law enforcement and worked with forensic investigators to determine the nature and scope of the incident. Following its investigation, Blackbaud notified its customers that an unknown actor may have accessed or acquired certain Blackbaud customer data. Blackbaud reported that the data was exfiltrated by the threat actor at some point before Blackbaud locked the threat actor out of the environment on May 20, 2020. Upon learning of the Blackbaud incident, we immediately commenced an investigation to determine what, if any, sensitive HPCB data was potentially involved. This investigation included working diligently to gather further information from Blackbaud to understand the scope of the incident.
Our investigation determined that the involved Blackbaud systems contained first and last names and one or more of the following data elements: addresses, primary caregiver information, date of death, and patient identification number. To date, we have not received confirmation from Blackbaud that HPCB patient specific information was accessed or acquired by the unknown actor.
HPCB is mailing notice letters to individuals for whom it has address information and whose protected information resides in the potentially impacted Blackbaud systems. The notice letter encourages potentially impacted individuals to remain vigilant against incidents of identity theft and fraud, to review account statements, credit reports, and explanation of benefits forms for suspicious activity and report any suspicious activity immediately to their insurance company, health care provider, or financial institution. HPCB is providing potentially impacted individuals information on obtaining a free credit report annually from each of the three major credit reporting bureaus by visiting www.annualcreditreport.com, calling 877-322-8228, or contacting the three major credit bureaus directly at: Equifax, P.O. Box 105069, Atlanta, GA, 30348, 1-800-685-1111, www.equifax.com; Experian, P.O. Box 2002, Allen, TX 75013, 888-397-3742, www.experian.com; TransUnion, P.O. Box 2000, Chester, PA 19016, 800-680-7289, www.transunion.com. Potentially impacted individuals may also find information regarding identity theft, fraud alerts, security freezes, and the steps they may take to protect their information by contacting the credit bureaus, the Federal Trade Commission, or their state Attorney General. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261. Instances of known or suspected identity theft should also be reported to law enforcement or the individual’s state Attorney General. We provided notice of this incident to the U.S. Department of Health and Human Services (HHS), as well as required state regulators.
The confidentiality, privacy, and security of information in our care are among our highest priorities, and we takes this incident very seriously. As part of our ongoing commitment to the security of information, we are working to review existing policies and procedures regarding third-party vendors, and are working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future.
Individuals seeking additional information can write to HPCB at 225 Como Park Boulevard, Cheektowaga, NY 14277 or call 716-989-2073.