CHESAPEAKE, Va. (AP) — A healthcare system based in Virginia says its third-party vendor experienced a data security breach earlier this year that affected more than 23,000 patients, donors and employees of the system.

Chesapeake Regional Healthcare said in a statement Tuesday that they have notified the people affected.

The data breach against its fundraising and data hosting vendor, Blackbaud, happened in February and may have also reoccurred until May 20.

The breach removed files from Blackbaud may have included names, mail and email addresses and other information of the people affected.

The healthcare system says the breach presents a low-risk for identity theft since credit card information or other personal identification information was not accessed.