Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Breaches

Nonprofit Service Provider Blackbaud Settles Data Breach Case for $49.5M With States

The fundraising software company Blackbaud has agreed to pay $49.5 million to settle claims brought by the attorneys general of 49 states and Washington, D.C., related to a 2020 data breach.

The fundraising software company Blackbaud agreed Thursday to pay $49.5 million to settle claims brought by the attorneys general of 49 states and Washington, D.C., related to a 2020 data breach that exposed sensitive information from 13,000 nonprofits.

Health information, Social Security numbers and the financial information of donors or clients of the nonprofits, universities, hospitals and religious organizations that the company serves was the type of data that was exposed in the breach, according to Indiana Attorney General Todd Rokita, who co-led the investigation with Vermont.

Blackbaud, which offers software for fundraising and data management to nonprofits, first publicly acknowledged that an outside actor had gained access to its data on July 16, 2020, but downplayed the extent and sensitivity of the information that had been stolen, the attorneys general said. Over a million files were exposed in the breach.

The company paid the intruder a ransom in exchange for deleting the data.

Blackbaud agreed to strengthen its data security practices, improve customer notification in the event of another breach and to have an outside party assess its compliance with the terms of the settlement for seven years, the settlement said.

The company did not admit any wrongdoing under the terms of the agreement. Blackbaud said in a statement that it expected to pay the full settlement amounts in October.

Indiana will receive almost $3.6 million under the terms of the settlement, the most of any state, Rokita’s office said.

In March, the U.S. Security’s and Exchange Commission said it settled charges against Blackbaud for misleading investors about the nature of the information that was stolen. After initially saying that bank information and Social Security numbers were not accessed in the breach, employees of the company found that it had been but failed to notify senior leaders, the SEC said.

Advertisement. Scroll to continue reading.

The company agreed to pay a $3 million fine to the SEC but did not admit wrongdoing.

Related: California Settles With Google Over Location Privacy Practices for $93 Million

Related: Microsoft Will Pay $20M to Settle US Charges of Illegally Collecting Children’s Data

Related: Amazon Settles Ring Customer Spying Complaint

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.

Register

As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.

Register

Expert Insights

Related Content

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Incident Response

Microsoft has rolled out a preview version of Security Copilot, a ChatGPT-powered tool to help organizations automate cybersecurity tasks.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

Data Breaches

KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.