Blackbaud Fined $3M for 'Failing to Disclose' That Ransomware Attack Breached Private Data -- THE Journal

Breaking News

Blackbaud Fined $3M for 'Failing to Disclose' That Ransomware Attack Breached Private Data

By Kristal Kuykendall
03/17/23

Blackbaud, a South Carolina-based provider of administrative, donor management, and CRM software to education and nonprofit organizations, has been fined $3 million by the U.S. Securities and Exchange Commission "for making misleading disclosures about a 2020 ransomware attack that impacted more than 13,000 customers,” the federal agency said.

The SEC order said that during the ransomware attack, bank account information and Social Security numbers of donors stored by Blackbaud customers were stolen by the attackers, but Blackbaud had told customers the opposite and subsequently omitted the information in quarterly filings with the SEC.

“On July 16, 2020, Blackbaud announced that the ransomware attacker did not access donor bank account information or Social Security numbers. Within days of these statements, however, the company’s technology and customer relations personnel learned that the attacker had in fact accessed and exfiltrated this sensitive information,” said the SEC order. “These employees did not communicate this information to senior management responsible for its public disclosure because the company failed to maintain disclosure controls and procedures.”

In its August 2020 quarterly report filed with the SEC, Blackbaud “omitted this material information about the scope of the attack and misleadingly characterized the risk of an attacker obtaining such sensitive donor information as hypothetical,” the agency said.

“Public companies have an obligation to provide their investors with accurate and timely material information; Blackbaud failed to do so,” said David Hirsch, chief of the SEC Enforcement Division’s Crypto Assets and Cyber Unit.

The agency ruled that Blackbaud violated two sections of the Securities Act of 1933 and one section of the Securities Exchange Act of 1934 as well as Rules 12b-20, 13a-13, and 13a-15(a).

“Without admitting or denying the SEC’s findings, Blackbaud agreed to cease and desist from committing violations of these provisions” and to pay the fine of $3 million, the agency said.

According to its website, Blackbaud provides cloud-based software for education and nonprofit fundraising and donor relationship management, enrollment, finance, grants and awards, and marketing management.

About the Author

Kristal Kuykendall is editor, 1105 Media Education Group. She can be reached at [email protected].

E-Mail this page

Printable Format

Featured

Presidential AI Challenge Seeks Innovative AI Solutions for Learning and Community

The White House has officially launched its Presidential AI Challenge, an initiative first announced in President Donald Trump's April 23 Executive Order on AI education.
Cambium Learning Group to Combine ExploreLearning and Learning A-Z Brands

Ed tech company Cambium Learning Group has announced plans to combine its ExploreLearning and Learning A-Z brands, with a new name and brand identity to be introduced in early 2026.
Report Explores Link Between Student Engagement and Learning

Over 90% of teachers, principals, and superintendents agree that student engagement is a critical metric for understanding overall achievement, according to a new survey report from Discovery Education.
New National Academy for AI Instruction to Provide Free AI Training for Educators

In an effort to "transform how artificial intelligence is taught and integrated into classrooms across the United States," the American Federation of Teachers (AFT), in partnership with Microsoft, OpenAI, Anthropic, and the United Federation of Teachers, is launching the National Academy for AI Instruction, a $23 million initiative that will provide access to free AI training and curriculum for all AFT members, beginning with K-12 educators.