Import Information About Your Data

 

The information below relates to a data breach experienced by a technology provider used by St Albans School. It is important to explain to Old Albanians what we know from the provider, the steps we are taking, and what this means for you.  This incident also involves a significant number of UK and US healthcare, educational and not-for-profit organisations, as well as St Albans School data.

 

We take our data protection responsibilities very seriously. We immediately launched our own investigation and further details are provided below, including the steps we have taken in response.

 

What happened?

 

The provider is Blackbaud, one of the world’s largest providers of customer relationship management systems for not-for-profit organisations, who experienced a ransomware attack on its systems where cybercriminals were able to remove a copy of a subset of our data. The breach occurred between February and May this year, and Blackbaud informed its customers on 16 July. We use Blackbaud’s platform Raiser’s Edge to host our Old Albanians’ database, managed by the Development Team, and more recently their platform NetCommunity, known to you as OA Connect (this website).

 

Blackbaud has stated that the stolen data has been destroyed, and Blackbaud is accelerating its efforts to further secure its environment to reduce the chances of a repeat attack.

 

We have spoken at length with Blackbaud to confirm the data that has been exposed. In the case of St Albans School, this is only basic information that is pulled into this website such as name, address and date of birth. We can confirm that only those OAs who have logged in or activated their NetCommunity account were affected and only the completed fields on OA Connect have been exposed.  Please note, those OAs whose data was stolen have already been notified.  If you have not received an email from the School about this, your data has not been affected by this incident.

 

Furthermore, we can confirm the following from Blackbaud:

- A detailed forensic investigation was undertaken, on behalf of Blackbaud, by law enforcement and third-party cyber security experts; 

- The investigation found that no encrypted information, such as bank account details or passwords, was accessed; 

- No credit card information formed part of the data theft.

 

What is the School doing?

 

The security of personal data is of utmost importance to the School, and we take our compliance responsibilities extremely seriously. We have been working closely with our experienced Data Protection Officer, Marc Davies of GDS Analytics Limited, to ensure the steps we take are compliant and comprehensive. 

 

We are taking the following steps:

 

- Closely monitoring Blackbaud’s response to this incident;

- Working with Blackbaud to understand why there was a delay between them finding the breach and notifying us, as well as what actions they have taken to increase their security;

- Reporting a data breach to the Information Commissioner’s Office (ICO) – as the data controller of your personal data we have an obligation and responsibility to report this data breach;

- Reporting the breach as a Serious Incident to the Charity Commission in accordance with regulatory requirements – this will be approved by the School’s governors;

- Reviewing our use of Blackbaud moving forward, taking into consideration their response to the breach.

 

What does this mean for you?

 

Please note, those OAs whose data was stolen have already been notified.  If you have not received an email from the School about this, your data has not been affected by this incident.

 

For those OAs who have been notified by the School, the fields that are visible and populated on OA Connect have been exposed in the breach; however, it is important to note that Blackbaud has taken steps for the stolen data to be destroyed.

 

There are no specific actions to be taken at this stage, but just to be vigilant as a best practice. We will continue to work with Blackbaud to understand the impact of this breach and will notify you immediately if we identify any action you need to take. 

 

We very much regret the inconvenience that this data breach by Blackbaud may have caused and send our sincere apologies. Please be assured that we take data protection very seriously and we are grateful for your continued support of and engagement with the School. Please do not hesitate to get in touch with Kate Gray, Development Director, at kgray@st-albans.herts.sch.uk if you have any further concerns or questions.

 

 

 

 

OAs, DUE TO SCHOOL CLOSURES AND THE CURRENT CLIMATE IN THE UK, WE ARE HAVING TO MAKE SOME NECESSARY CHANGES TO PLANNED EVENTS. PLEASE CHECK YOUR EMAILS, THIS WEBSITE AND OUR SOCIAL MEDIA PAGES FOR FURTHER UPDATES.

 

COVID-19 MESSAGE 

 

During these unprecedented times, the safety and welfare of our alumni community is paramount. The current social distancing guidelines are no doubt having an adverse effect on some of our OAs and we would like to extend our support to those in need.  

 

If you are feeling particularly isolated or struggling to make connections from home, we are here to help. Please login and use OA Connect to find and reconnect with your classmates using the Find OAs function. Remember to also update your details under My Profile so OAs can find you.  

 

We will continue to send out Versa and various communications during this difficult time. Do you have any advice or tips for those struggling with self-isolation? Do you have a story you would like to share? Get in touch and we can send to our community!  

 

We’re here to help. If we can support you in another way or help you connect with other alumni, please do let us know.   

 

Best wishes 
Kate, Chris, Sarah & Sue