Blackbaud Inc. will have to delete personal data it does not need and overhaul its security under a proposed settlement with the Federal Trade Commission over the 2020 ransomware attack on the Daniel Island software company.
The FTC announced the proposed order Thursday. In a complaint, the agency says Blackbaud’s lax security allowed a hacker to breach its network and reach the personal data of millions of consumers, including Social Security and bank account numbers.
Blackbaud was not fined and is not required to make any payment, the company said Friday. It agreed to the order without admitting or denying the FTC’s allegations, according to a filing with the Securities and Exchange Commission.
“We are pleased to resolve this matter with the FTC,” CEO Mike Gianoni said in a statement. “Protecting our customers’ and their constituents’ privacy will always be of paramount importance to Blackbaud, and we continue to strengthen our cybersecurity and compliance programs with the goal of improving our resilience in an ever-changing threat landscape.”
What the FTC alleges
The FTC says Blackbaud, which provides data services and financial, fundraising and administrative software to companies, nonprofits, health care organizations and others, failed to put appropriate safeguards on the vast amounts of personal data it maintains for those clients.
“Blackbaud’s shoddy security and data retention practices allowed a hacker to obtain sensitive personal data about millions of consumers,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection. “Companies have a responsibility to secure data they maintain and to delete data they no longer need.”
According to the complaint, Blackbaud failed to monitor attempts to breach its networks, segment its data, make sure data it no longer needed was deleted, adequately use multifactor authentication and test its security controls. The FTC also says the company let employees use default, weak or identical passwords.
A hacker got into a customer’s Blackbaud-hosted database in early 2020 and moved freely across several Blackbaud-hosted environments, according to the complaint. The FTC says the breach went undetected for three months, allowing the hacker to remove massive amounts of unencrypted consumer data.
The agency also says Blackbaud kept data far longer than it needed to, including information belonging to former customers.
The ransom
Once it detected the breach, Blackbaud agreed to pay a ransom of 24 Bitcoin, worth about $250,000, after the hacker threatened to expose the stolen data, the FTC says. The company never verified that the hacker actually deleted the data, according to the complaint.
The FTC also says Blackbaud waited nearly two months to tell customers about the breach and then misled consumers about the extent of the data stolen, telling customers they did not need to take any action. It says the company knew as early as the end of July 2020 that the hacker had obtained sensitive data including Social Security and bank account information, but waited another two months to tell customers the full scope.
What the order requires
The proposed order requires Blackbaud to delete data it no longer needs to provide products or services, bars it from misrepresenting its data security and retention policies, and requires a comprehensive information security program, the FTC said.
Blackbaud also must adopt a data retention schedule explaining why it keeps personal data and when it will delete it. And it must notify the FTC of any future data breach it is required to report to another local, state or federal agency.
The commission voted 3-0 to issue the complaint and accept the proposed consent agreement. Chair Lina M. Khan and Commissioners Rebecca Kelly Slaughter and Alvaro Bedoya issued a joint statement.
The agreement will be open for public comment for 30 days after it is published in the Federal Register. The commission will then decide whether to make the order final. Each violation of a final order could bring a civil penalty of up to $51,744, the FTC said.
Earlier settlements
The FTC case follows two other government settlements over the same attack.
In March 2023, Blackbaud agreed to pay a $3 million civil penalty to settle SEC charges that it made misleading disclosures about the attack. The SEC said that in July 2020, Blackbaud told the public the attacker had not accessed donor bank account information or Social Security numbers, but that company employees learned within days that the attacker had taken that data. Blackbaud neither admitted nor denied the SEC’s findings.
In October 2023, Blackbaud agreed to pay $49.5 million to 49 state attorneys general and the District of Columbia to resolve their joint investigation. California did not take part and has its own investigation, which had not been resolved, according to the company’s most recent quarterly report, filed in November.
Blackbaud said its incident-related costs exceeded the limit of its $50 million in insurance coverage in the first quarter of 2022. In the first nine months of 2023, it recorded $48.6 million in net pre-tax expenses tied to the incident, according to its quarterly report.
The company also faces customer claims and consumer class actions in U.S. federal courts and in Canada, the report said.
Blackbaud employed more than 3,200 people at the end of 2022 and describes itself as a remote-first company.
