Blackbaud to Pay $3M Fine for 'Misleading' Customers Following 2020 Ransomware Attack, Data Breach

Blackbaud, a South Carolina-based provider of administrative, donor management, and CRM software to thousands of K–12 private schools, higher education institutions, and nonprofits, has been ordered by the U.S. Securities and Exchange Commission to pay a fine of $3 million to “settle charges for making misleading disclosures about a 2020 ransomware attack that impacted more than 13,000 customers,” the federal agency said in a news release.

The SEC order said that during the ransomware attack, bank account information and Social Security numbers of donors stored by Blackbaud customers were stolen by the attackers, but Blackbaud had told customers the opposite and subsequently omitted the information in quarterly filings with the SEC. 

“On July 16, 2020, Blackbaud announced that the ransomware attacker did not access donor bank account information or Social Security numbers. Within days of these statements, however, the company’s technology and customer relations personnel learned that the attacker had in fact accessed and exfiltrated this sensitive information,” said the SEC order. “These employees did not communicate this information to senior management responsible for its public disclosure because the company failed to maintain disclosure controls and procedures.” 

In its August 2020 quarterly report filed with the SEC, Blackbaud “omitted this material information about the scope of the attack and misleadingly characterized the risk of an attacker obtaining such sensitive donor information as hypothetical,” the agency said.

“Public companies have an obligation to provide their investors with accurate and timely material information; Blackbaud failed to do so,” said David Hirsch, chief of the SEC Enforcement Division’s Crypto Assets and Cyber Unit. 

The agency ruled that Blackbaud violated two sections of the Securities Act of 1933 and one section of the Securities Exchange Act of 1934 as well as Rules 12b-20, 13a-13, and 13a-15(a). 

“Without admitting or denying the SEC’s findings, Blackbaud agreed to cease and desist from committing violations of these provisions” and to pay the fine of $3 million, the agency said.

According to its website, Blackbaud provides cloud-based software for education and nonprofit fundraising and donor relationship management, enrollment, finance, grants and awards, and marketing management. 

Its education customer base includes “24 of 25 top private U.S. colleges as ranked by Forbes,” the Blackbaud website says, and its software powers “93% of higher education institutions with billion-dollar campaigns.” Major universities using its donor management and CRM software include University of Georgia, Notre Dame, University of Louisville, and California State University Long Beach, according to Blackbaud.com.

 

 

About the Author

Kristal Kuykendall is editor, 1105 Media Education Group. She can be reached at [email protected].


Featured

  • UIUC Study: AI Agents Can Exploit Cybersecurity Vulnerabilities

    In a new study from the University of Illinois Urbana-Champaign (UIUC), researchers demonstrated that large language model agents can autonomously exploit real-world cybersecurity vulnerabilities, raising critical concerns about the widespread deployment and security of these advanced AI systems.

  • Bryant University Launches Gen AI Chatbot for Community Engagement

    Students, faculty, and staff at Bryant University have a new resource for accessing information, receiving guidance, and keeping up with campus events. The institution recently launched a generative AI chatbot developed in partnership with AI and intelligent automation solution provider alliantDigital.

  • stylized illustration of a global AI treaty signing, featuring diverse human figures seated around a round table

    World Leaders Sign First Global AI Treaty

    The United States, the United Kingdom, the European Union, and several other countries have signed "The Framework Convention on Artificial Intelligence, Human Rights, Democracy, and the Rule of Law," the world's first legally binding treaty aimed at regulating the use of artificial intelligence (AI).

  • clock with gears and digital circuits inside

    Report Pegs Cost of AI at Nearly $300K Per Minute

    A new report from cloud-based data/BI specialist Domo provides a staggering estimate of the minute-by-minute impact of today's generative AI boom.