Nonprofit Service Provider Blackbaud Settles Data Breach Case with States for $49.5 Million

### Background

The fundraising software company Blackbaud recently agreed to pay $49.5 million to settle claims brought by the attorneys general of 49 states and Washington, D.C. This settlement is related to a 2020 data breach that exposed sensitive information from 13,000 nonprofits. The breach exposed health information, Social Security numbers, and financial information of donors or clients of the nonprofits, universities, hospitals, and religious organizations that Blackbaud serves.

Blackbaud first publicly acknowledged the data breach on July 16, 2020. However, they initially downplayed the extent and sensitivity of the information that had been stolen. It was later revealed that over a million files were exposed in the breach. Blackbaud paid the intruder a ransom in exchange for deleting the stolen data.

### Settlement Details

Under the settlement, Blackbaud has agreed to strengthen its data security practices, improve customer notification in the event of another breach, and have an outside party assess its compliance with the terms of the settlement for seven years. It is noteworthy that the company did not admit any wrongdoing under the terms of the agreement.

Blackbaud has announced that it expects to pay the full settlement amount in October. Indiana will receive the largest share of the settlement, with almost $3.6 million allocated to the state.

### Legal and Regulatory Action

In addition to the settlement with the attorneys general, Blackbaud also faced legal action from the U.S. Securities and Exchange Commission (SEC) in relation to the data breach. The SEC accused Blackbaud of misleading investors about the nature of the stolen information. Initially, the company claimed that bank information and Social Security numbers were not accessed in the breach. However, later investigations revealed that this information had indeed been accessed, but Blackbaud failed to notify senior leaders. To settle the SEC charges, Blackbaud agreed to pay a $3 million fine without admitting any wrongdoing.

### Analysis and Commentary

The settlement between Blackbaud and the attorneys general highlights the serious consequences of data breaches for both companies and their customers. Nonprofits, universities, hospitals, and religious organizations rely on service providers like Blackbaud to securely manage their sensitive data. When such service providers fail to protect this data, it can lead to significant harm to individuals and organizations alike.

This case raises important questions about the responsibilities and accountability of service providers when it comes to data security. Blackbaud‘s initial downplaying of the breach and failure to notify senior leaders about the extent of the stolen data is a clear example of the need for greater transparency and honesty during such incidents. It is essential for organizations to prioritize the interests of their customers and promptly disclose all relevant information in the event of a data breach.

The settlement also highlights the increasing costs associated with data breaches. The $49.5 million settlement is a significant financial burden for Blackbaud, and it is likely that more companies will face similar consequences in the future. This serves as a reminder to organizations of all sizes and industries to invest in robust cybersecurity measures and protocols to prevent data breaches.

### Advice and Recommendations

For organizations that rely on third-party service providers to handle sensitive data, it is crucial to thoroughly assess the security measures and policies of these providers. This includes conducting due diligence, reviewing previous incidents, and ensuring that proper safeguards are in place to protect the data entrusted to them.

Furthermore, organizations should prioritize transparency and effective communication when responding to data breaches. Promptly notifying customers and stakeholders about the breach, its potential impact, and the steps being taken to mitigate further risks is essential for maintaining trust and minimizing harm.

Lastly, organizations should regularly review and update their cybersecurity frameworks to adapt to evolving threats and industry standards. Investing in employee training, implementing multi-factor authentication, encrypting data, and performing regular security audits are some of the best practices that can help mitigate the risk of data breaches.

### Conclusion

The settlement between Blackbaud and the attorneys general is a significant development in the aftermath of the 2020 data breach. It highlights the importance of data security for service providers and the need for greater accountability and transparency in handling data breaches. As organizations continue to rely on third-party service providers, it is crucial for them to prioritize cybersecurity and adopt comprehensive measures to protect sensitive information. Only through such proactive efforts can organizations prevent future data breaches and safeguard the privacy and trust of their customers.