Blackbaud Inc. will pay a $3 million civil penalty to settle federal charges that it misled investors about how much sensitive donor information a hacker stole in 2020.
The Securities and Exchange Commission announced the settlement Thursday. Blackbaud agreed to the SEC’s order without admitting or denying its findings, the Daniel Island company said in a filing.
“As the order finds, Blackbaud failed to disclose the full impact of a ransomware attack despite its personnel learning that its earlier public statements about the attack were erroneous,” said David Hirsch, chief of the SEC Enforcement Division’s Crypto Assets and Cyber Unit, in the agency’s announcement. “Public companies have an obligation to provide their investors with accurate and timely material information; Blackbaud failed to do so.”
What the SEC found
Blackbaud sells donor relationship management software to charities, colleges, K-12 schools, health care organizations and other nonprofits.
On May 14, 2020, Blackbaud’s technology staff detected an intruder in the company’s systems, according to the SEC’s order. The access may have begun as early as February 2020. The attacker left messages claiming to have taken customers’ data and demanded payment. Blackbaud, working through an outside vendor, paid a ransom in exchange for the attacker’s promise to delete the data, the order says.
The attacker took more than a million files tied to more than 13,000 customers, about a quarter of the company’s customers, according to the order.
On July 16, 2020, Blackbaud disclosed the attack on its website and notified affected customers. Those notices said the cybercriminal did not access bank account information or Social Security numbers.
Within days, the SEC says, Blackbaud employees learned that was wrong. Customers sent the company more than a thousand messages about the attack, and a number of them said they had stored Social Security numbers and bank account numbers in fields or attachments that were not encrypted. By July 21, staff had written a script for customer service workers acknowledging that some of those fields were not encrypted. By the end of July, employees had confirmed the attacker had taken some of that data, the order says.
That information did not reach the senior managers responsible for Blackbaud’s public disclosures until several weeks later, according to the SEC. The company had no policies or procedures designed to make sure it would.
On Aug. 4, 2020, Blackbaud filed its quarterly report with the SEC. It said only that “the cybercriminal removed a copy of a subset of data,” and it described the risk of donor data being taken as hypothetical. The SEC found that the report left out material facts.
Blackbaud first acknowledged on Sept. 29, 2020, that the attacker may have accessed some unencrypted fields meant for bank account information, Social Security numbers, usernames or passwords.
The violations
The SEC found that Blackbaud violated provisions of the Securities Act of 1933 that prohibit misleading statements and omissions in the offer or sale of securities. Those violations do not require proof of intent and can rest on a finding of negligence, the order says. The company also violated reporting and disclosure-control rules under the Securities Exchange Act of 1934, the SEC found. During the period in question, the company was selling stock to its own employees through an equity compensation plan, the order notes.
Blackbaud agreed to a cease-and-desist order and to pay the penalty within 14 days. The SEC said its investigation had help from the Federal Trade Commission and the attorneys general of Indiana and Vermont.
The settlement “fully resolves” the SEC’s investigation of the incident, Blackbaud said in its filing.
What is still open
The SEC case is one of several the attack set off. In its annual report, filed Feb. 24, Blackbaud listed open investigations by the Federal Trade Commission, the U.S. Department of Health and Human Services, privacy regulators in Australia and Canada, and attorneys general in 49 states and the District of Columbia. The attorneys general of Indiana and California have also issued separate demands for information.
The company also faces 19 proposed consumer class actions, 17 in U.S. federal courts that have been combined before a single court and two in Canada, the report says.
Blackbaud has recorded about $108 million in gross expenses tied to the incident through the end of 2022. Its insurance covered $50 million, and costs passed that limit in the first quarter of last year. The company has set aside about $23 million for possible losses, based mainly on talks with government agencies, and expects net pre-tax expense of $20 million to $30 million this year for ongoing legal fees.
Blackbaud had more than 3,200 employees at the end of 2022, according to the annual report.
