Analyst Note: Ransomware operators rely heavily on their reputation to ensure ransom payments from their victims. Ransomware operators gain little by releasing data after ransom is paid since it would encourage others to not pay ransoms. Early detection of ransomware allowed for decreased damage in this instance since systems were not encrypted. Endpoint detection and response solutions are an important preventative measure to combat a number of threats such as ransomware. Darknet monitoring is an import step for both pre- and post-incident monitoring. Post-incident monitoring allows for the potential to obtain stolen data prior to its sale to other criminals, as well as the identification of stolen data for sale prior to its use by criminals. Pre-incident Darknet monitoring allows for the identification of compromised email accounts which have been posted in data dumps. These compromised email accounts are a great tool for criminals to target members of an organization and establish an initial foothold to carry out a number of attacks–including ransomware attacks. More information on this incident can be found at https://www.thenonprofittimes.com/npt_articles/breaking-blackbaud-hacked-ransom-paid/
The statement on this incident from Blackbaud can be found at https://www.blackbaud.com/securityincident