Blackbaud Agrees to Pay $3 Million to Settle Charges Over Misleading Disclosures of Ransomware Attack

Blackbaud Inc., a South Carolina-based public company that provides donor data management software to non-profit organizations, has agreed to pay a $3 million civil penalty to settle charges over misleading disclosures about a 2020 ransomware attack that impacted more than 13,000 customers. The SEC announced the settlement on March 9, 2023.

Misleading Disclosures

On July 16, 2020, Blackbaud announced that the ransomware attacker did not access donor bank account information or social security numbers. However, within days, the company’s technology and customer relations personnel learned that the attacker had accessed and exfiltrated this sensitive information. Unfortunately, these employees did not communicate this information to senior management responsible for public disclosure. This was due to the company’s failure to maintain disclosure controls and procedures. As a result, in August 2020, the company filed a quarterly report with the SEC that omitted material information about the scope of the attack and misleadingly characterized the risk of an attacker obtaining such sensitive donor information as hypothetical.

SEC’s Order

The SEC’s order finds that Blackbaud violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 and Section 13(a) of the Securities Exchange Act of 1934 and Rules 12b-20, 13a-13, and 13a-15(a) thereunder. Blackbaud agreed to cease and desist from committing violations of these provisions and pay a $3 million civil penalty without admitting or denying the SEC’s findings.

Read the Full Press Release

Have a securities law question? Call New York Securities Lawyers at 212-509-6544.

Related Articles

• SEC Small Business Advisory Committee to Discuss IPO Modernization and Regulation Crowdfunding
• SEC Proposes Expanding Securities Eligible for Cross Trading by Registered Funds
• SEC Seeks Final Judgment Against Former Western Asset Co-CIO Ken Leech in Cherry Picking Case
• SEC to Host Virtual National Compliance Outreach Seminar for Investment Companies and Investment Advisers
• SEC Coordinates with Global Financial Regulators to Raise Fraud Awareness During World Investor Week
• SEC’s Division of Examinations Announces New Exam Handbook
• SEC Proposes Amendments to Expand Responsible Retailization of Private Markets
• SEC Proposal Would Address How Investment Advisers and Funds Can Custody Crypto Assets Under the Federal Securities Laws
• SEC Charges Two Individuals With Orchestrating Fraud Scheme That Targeted Veterans
• SEC Charges Meyer Global Management and Its CEO With Defrauding Retail Investors in Private Funds That Held Interests in SpaceX and Other Pre-IPO Securities
• SEC Charges Multiple Entities in Fraud Schemes Totaling at Least $15 Million That Used WhatsApp and Other Platforms to Lure Investors
• SEC Charges Registered Investment Adviser Zoe Financial for Failure to Disclose Conflict of Interest
• SEC Charges South Florida Resident and His Company for Alleged Investment Scheme Defrauding Law Enforcement
• SEC Publishes Updated Market Statistics, Highlighting Increase in IPOs and Proceeds Raised
• SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI