Seeds of Peace, and many other nonprofit organizations and educational institutions, rely on a software provider called Blackbaud for database and relationship management services. On July 16, 2020, Blackbaud informed us that between February and May 2020, they experienced a data security incident that resulted in the unauthorized acquisition of data impacting a large group of the organizations to whom they provide services, including Seeds of Peace.
What Information Was Involved?
Based on our ongoing investigation, the Seeds of Peace information impacted involved backup files that may have contained names, a limited number of Social Security Numbers, dates of birth, passport numbers, contact information, demographic information, and donation histories. Blackbaud has assured us that the attacker did not gain access to any bank account or credit card information.
What We Are Doing?
Promptly after Blackbaud notified us of this incident, we took steps to determine its nature and scope, including whether any personal information was impacted. Blackbaud has indicated to us that, based on its investigation, they do not believe that any Seeds of Peace data has been misused or will be disseminated or otherwise made publicly available. We continue to investigate this incident and are coordinating closely with Blackbaud to monitor the situation. Blackbaud also has engaged third-party experts to actively monitor for suspicious activity and has not at this time identified any evidence that the Seeds of Peace data has been misused. In addition, Blackbaud has stated that it has implemented additional measures and safeguards to prevent this type of attack from happening again.
What Can You Do?
We take our obligation to safeguard personal information very seriously and are alerting those affected about this incident so they can take steps to help protect themselves. Steps they can take include the following:
· Register for Credit Monitoring Services. We have arranged to offer identity protection and credit monitoring services for two years at no cost for those with Social Security Numbers and non-expired U.S. passport numbers who are impacted. If you think you may have had this type of information compromised, please reach out to us at datasupportteam@seedsofpeace.org.
· Order a Credit Report. Those impacted are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order a free credit report, visit https://www.annualcreditreport.com or call toll-free at 1-877-322-8228. We encourage those impacted to remain vigilant by reviewing their account statements and monitoring their free credit reports.
· Review the Reference Guide below. The Reference Guide provides information on registration and recommendations by the U.S. Federal Trade Commission on the protection of personal information.
For More Information
We take the security of personal information very seriously. We hope this information and the Reference Guide below are useful. If you have any questions regarding this incident, please email us at datasupportteam@seedsofpeace.org.
Sincerely,
Jenna Markowitz
Legal and Business Affairs Director, Seeds of Peace
Lele Levay
Director of Advancement, Seeds of Peace
Marni Pearce
Director of Data and Development Operations, Seeds of Peace
REFERENCE GUIDE
We encourage affected individuals to take the following steps:
Order Your Free Credit Report
To order your free credit report, visit https://www.annualcreditreport.com, call toll-free at 1-877-322-8228, or complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission’s (“FTC”) website at https://www.consumer.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. The three consumer reporting agencies provide free annual credit reports only through the website, toll-free number or request form.
When you receive your credit report, review it carefully. Look for accounts you did not open. Look in the “inquiries” section for names of creditors from whom you haven’t requested credit. Some companies bill under names other than their store or commercial names. The consumer reporting agency will be able to tell you when that is the case. Look in the “personal information” section for any inaccuracies in your information (such as home address and Social Security number). If you see anything you do not understand, call the consumer reporting agency at the telephone number on the report. Errors in this information may be a warning sign of possible identity theft. You should notify the consumer reporting agencies of any inaccuracies in your report, whether due to error or fraud, as soon as possible so the information can be investigated and, if found to be in error, corrected. If there are accounts or charges you did not authorize, immediately notify the appropriate consumer reporting agency by telephone and in writing. Consumer reporting agency staff will review your report with you. If the information can’t be explained, then you will need to call the creditors involved. Information that can’t be explained also should be reported to your local police or sheriff’s office because it may signal criminal activity.
Report Incidents
If you detect any incident of identity theft or fraud, promptly report the incident to law enforcement, the FTC and your state Attorney General. If you believe your identity has been stolen, the FTC recommends that you take these steps:
· Close the accounts that you have confirmed or believe have been tampered with or opened fraudulently. For streamlined checklists and sample letters to help guide you through the recovery process, please visit https://www.identitytheft.gov/.
· File a local police report. Obtain a copy of the police report and submit it to your creditors and any others that may require proof of the identity theft crime.
You can contact the FTC to learn more about how to protect yourself from becoming a victim of identity theft and how to repair identity theft:
Federal Trade Commission Consumer Response Center
600 Pennsylvania Avenue,
NW Washington, DC 20580
1-877-IDTHEFT (438-4338)
https://www.ftc.gov/idtheft/
Consider Placing a Fraud Alert on Your Credit File. To protect yourself from possible identity theft, consider placing a fraud alert on your credit file. A fraud alert helps protect you against the possibility of an identity thief opening new credit accounts in your name. When a merchant checks the credit history of someone applying for credit, the merchant gets a notice that the applicant may be the victim of identity theft. The alert notifies the merchant to take steps to verify the identity of the applicant. You can place a fraud alert on your credit report by calling any one of the toll-free numbers provided below. You will reach an automated telephone system that allows you to flag your file with a fraud alert at all three consumer reporting agencies. For more information on fraud alerts, you also may contact the FTC as described above.
Equifax Information Services LLC
P.O. Box 740241 Atlanta, GA 30374
1-800-525-6285 https://www.equifax.com
Experian Inc.
P.O. Box 9554 Allen, TX 75013
1-888-397-3742 https://www.experian.com
TransUnion LLC
P.O. Box 2000 Chester, PA 19016
1-800-680-7289 https://www.transunion.com
Consider Placing a Security Freeze on Your Credit File
You may wish to place a “security freeze” (also known as a “credit freeze”) on your credit file. A security freeze is designed to prevent potential creditors from accessing your credit file at the consumer reporting agencies without your consent. Unlike a fraud alert, you must place a security freeze on your credit file at each consumer reporting agency individually. There is no charge to place or lift a security freeze. For more information on security freezes, you may contact the three nationwide consumer reporting agencies or the FTC as described above. As the instructions for establishing a security freeze differ from state to state, please contact the three nationwide consumer reporting agencies to find out more information.
The consumer reporting agencies may require proper identification prior to honoring your request. For example, you may be asked to provide:
· Your full name with middle initial and generation (such as Jr., Sr., II, III)
· Your Social Security Number
· Your date of birth
· Addresses where you have lived over the past five years
· A legible copy of a government-issued identification card (such as a state driver’s license or military ID card)
· Proof of your current residential address (such as a current utility bill or account statement)
For Maryland Residents
You can obtain information from the Maryland Office of the Attorney General about steps you can take to avoid identity theft. You may contact the Maryland Attorney General at:
Maryland Office of the Attorney General Consumer Protection Division
200 St. Paul Place
Baltimore, MD 21202
(888) 743-0023 (toll-free in Maryland)
(410) 576-6300
https://www.marylandattorneygeneral.gov
For Massachusetts Residents
You have the right to obtain a police report and request a security freeze as described above. The consumer reporting agencies may require that you provide certain personal information (such as your name, Social Security number, date of birth, and address) and proper identification (such as a copy of a government-issued ID card and a bill or statement) prior to honoring your request to place a security freeze on your account.
For New Mexico residents
You have rights pursuant to the Fair Credit Reporting Act, such as the right to be told if information in your credit file has been used against you, the right to know what is in your credit file, the right to ask for your credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the Fair Credit Reporting Act, the consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to your file is limited; you must give your consent for credit reports to be provided to employers; you may limit “prescreened” offers of credit and insurance you get based on information in your credit report; and you may seek damages from violator. You may have additional rights under the Fair Credit Reporting Act not summarized here. Identity theft victims and active duty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act. We encourage you to review your rights pursuant to the Fair Credit Reporting Act by visiting https://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf, or by writing Consumer Response Center,
Room 130-A, Federal Trade Commission,
600 Pennsylvania Ave. N.W.,
Washington, D.C. 20580.
For New York Residents
You can obtain information from the New York State Office of the Attorney General about how to protect yourself from identity theft and tips on how to protect your privacy online. You can contact the New York State Office of the Attorney General at:
Office of the Attorney General
The Capitol
Albany, NY 12224-0341
1-800-771-7755 (toll-free)
1-800-788-9898 (TDD/TTY toll-free line)
https://ag.ny.gov/
Bureau of Internet and Technology (BIT)
28 Liberty Street
New York, NY 10005
Phone: (212) 416-8433
https://ag.ny.gov/internet/resource-center
For North Carolina Residents
You can obtain information from the North Carolina Attorney General’s Office about preventing identity theft. You can contact the North Carolina Attorney General at:
North Carolina Attorney General’s Office
9001 Mail Service Center
Raleigh, NC 27699-9001
(877) 566-7226 (toll-free in North Carolina)
(919) 716-6400
https://www.ncdoj.gov
For Rhode Island Residents
You may obtain information about preventing and avoiding identity theft from the Rhode Island Office of the Attorney General at:
Rhode Island Office of the Attorney General
Consumer Protection Unit
150 South Main Street
Providence, RI 02903
(401) 274-4400
http://www.riag.ri.gov
You have the right to obtain a police report and request a security freeze as described above. The consumer reporting agencies may require that you provide certain personal information (such as your name, Social Security number, date of birth, and address) and proper identification (such as a copy of a government-issued ID card and a bill or statement) prior to honoring your request for a security freeze on your account. There is one Rhode Island resident impacted by this incident.
For Washington, D.C. Residents
You may obtain information about preventing and avoiding identity theft from the Office of the Attorney General for the District of Columbia at:
Office of the Attorney General for the District of Columbia
441 4th Street NW
Suite 1100 South
Washington, D.C. 20001
(202) 727-3400
https://oag.dc.gov/