When a vendor that holds your constituent data reports a security incident, the hardest part usually isn’t the technical review. It’s deciding what to tell members, donors, and visitors, and when. Say too little and you look evasive. Say too much before the facts are settled and you end up correcting yourself in public.
The Blackbaud ransomware incident disclosed in 2020 put thousands of nonprofits, including many cultural organizations running Altru, in exactly that spot. The same questions come up whenever a vendor sends a security notice. This guide covers how to get the facts straight, write a notice patrons can follow, and handle the replies.
One caveat up front: this is communications guidance from people who work with Altru data every day. It is not legal advice. Whether you are required to notify anyone, and what that notice must contain, depends on your state (and any other states or countries where your patrons live), on what data was involved, and on your contracts. Bring in your legal counsel or insurer before anything goes out.
Step one: pin down what was actually exposed
Everything you write depends on this, and vendor notices are often broad. Before drafting, get answers in writing:
- Which of your databases were affected. Production, backups, sandbox copies? Vendor notices sometimes talk about backup files rather than the live system, and that difference matters.
- Which data types. Names, addresses, emails, and giving history are one category. Bank account numbers, Social Security numbers, unencrypted card data, or login credentials are another, and they usually trigger formal notice requirements.
- What you actually store in Altru. Check your own setup rather than assuming. Look at which constituent record fields, attributes, and notes are in use. Some organizations find old free-text notes holding things that should never have been typed in, like birth dates, health details for accessibility requests, or partial payment details.
- The time window. A date range tells you which constituents could plausibly be affected. A query on records that existed during that window gives you a realistic audience size.
If the vendor can’t answer a question yet, write down that it’s open and who owns the follow-up. Don’t fill the gap with a guess.
Decide who hears what, and in what order
Not every audience needs the same message. A sensible order:
- Board and leadership first, with the full facts and the open questions.
- Front-line staff next: membership, development, admissions, and whoever answers the main phone. They’ll get questions the same day patrons read the notice, so they need a short script and a clear escalation contact.
- Major donors and key members may deserve a personal note or call from the director or development lead before the broader email lands.
- All affected constituents through whichever channel your counsel advises. That may be mail, email, or both.
- A public statement on your website if the incident is widely reported. Even a short page gives staff something to point people to.
What a good patron notice includes
Patrons don’t need a technical account. They need to know whether this affects them and what, if anything, they should do. A clear notice covers:
- What happened, in two or three plain sentences. Name the vendor if that’s been made public; patrons will find out anyway, and naming it reads as candor.
- What information was involved and, just as important, what was not. If no payment card or bank data was involved, say so directly.
- What you’re doing. Your own review, what you’ve asked of the vendor, any changes you’re making to what you store.
- What they can do. Be specific and proportionate. If only contact information was involved, the realistic risk is phishing, so tell people you’ll never ask for passwords or payment details by email and how to verify a message really came from you.
- A real contact. A named person or dedicated email address, not a general inbox that nobody watches.
Keep the tone steady. Avoid minimizing language like “a minor issue” if you don’t know that yet, and skip the alarm too. Short sentences, no jargon, an apology where it’s warranted.
Phrases to avoid
- “We take your privacy very seriously.” Everyone says it, so it reads as boilerplate. Show it with specifics instead.
- “There is no evidence your data was misused.” Use this only if your vendor has said it and you can attribute it. Otherwise it sounds like a promise you can’t keep.
- Anything that blames the vendor in a way that sidesteps your own responsibility. Patrons trusted you with their information.
Handling the replies
Expect a spike in calls, emails, and some cancellation requests. Plan for them:
- Track responses on the constituent record. An interaction or note with a consistent label lets you report later on who reached out, what they asked, and whether it was resolved.
- Honor opt-outs quickly. If someone asks to stop receiving mail or email, update their communication preferences in Altru the same day. Ignoring an opt-out right after a breach notice does real damage.
- Handle deletion requests carefully. Some patrons will ask you to delete their record. Donation and tax-receipt history may have retention requirements, so check with your finance team and counsel before removing anything. Marking the record inactive and stripping optional details may be a reasonable middle ground.
- Keep a running FAQ. When the same question comes in three times, add the answer to your public page and the staff script.
Use the moment to clean house
An incident is a good reason to look at what you keep and why. Review whether you still need old imported fields, free-text notes with sensitive details, or records for people who haven’t engaged in many years. Tighten Altru security roles so staff see only what their job requires. Confirm that exports to spreadsheets and outside tools are tracked and deleted once they’ve served their purpose. Every copy of constituent data sitting on a laptop is another place it can leak.
Finally, write a short internal record of what you sent, to whom, and when, plus what you’d change next time. If another vendor notice arrives, you’ll start from a tested plan instead of a blank page.
Quick answers
Do we have to notify patrons if our vendor already did?
Sometimes the vendor’s notice covers it and sometimes it doesn’t. Your organization usually has the relationship with the patron, and many laws place the duty on the data owner. Ask counsel.
Should we offer credit monitoring?
It’s generally expected when Social Security numbers or financial account data were exposed. For contact information only, it’s usually not necessary, but your counsel or insurer may advise differently.
