Re: Of course, the storage was actually illegal
Nowhere in the story does it say that the data was stored in US servers. The hacked servers are described as "self-hosted," so if the servers were administered by the universities, the onus of GPDR compliance was on them.
Which doesn't make any of this look any better for Blackbaud, of course.