US preservationist nonprofit suffers a ransomware attack; gets a ransom demand worth millions

US-based nonprofit Ohio History Connection said it suffered a cyber attack that compromised the sensitive personal information of thousands of individuals.

One of the oldest historical societies in the state of Ohio, the Ohio History Connection (OHC) is a nonprofit organisation that manages more than fifty historical sites and museums across the state.

In a recent data security incident notification posted on its website, the Ohio History Connection said that it suffered a ransomware attack in June that involved threat actors encrypting its systems and demanding a ransom to the tune of millions to provide a decryption key and release the data.

“On August 7, the cybercriminals rejected the offer. The personal information of certain stakeholders may now be accessible to those who may be looking for it,” the nonprofit said, adding that the stolen information included the names, addresses, and Social Security numbers of current and former OHC employees between 2009 and 2023.

“Cybercriminals may have gained access to W-9 reports and other records revealing the names and personal Social Security numbers of vendors who contracted to provide services to OHC. They also may have gained access to images of checks provided to OHC by some members and donors beginning in 2020,” the society added.

OHC has confirmed that at least 7,600 individuals’ personal data has been affected due to the security incident, but no credit card information was accessed or stolen by the ransomware actors.

While OHC said that it has no evidence that the compromised data has been misused, the possibility of the same can’t be ruled out. The organisation is providing complimentary credit monitoring and identity theft services via IDX to all affected individuals whose personal data has been compromised during the incident. Also, IDX has set up a helpline where affected people can call and get their queries answered.

OHC is also rebuilding its internal system and is in the process of getting its operations back to normal. The nonprofit said it has moved a vast majority of its data to cloud-based services, and has implemented new security systems, features and measures intended to reduce its vulnerability to future attacks and better protect personally identifiable information.