BLACKBAUD, INC.

On February 1, 2024, the FTC announced approval of a settlement with Blackbaud, Inc. resolving its investigation into the previously announced 2020 Security Incident, in which a cybercriminal removed a copy of a subset of data from Blackbaud's self-housed environment. Under the FTC's proposed order, Blackbaud agreed to certain conditions but was not fined and is not required to make any payment. Blackbaud neither admitted nor denied the allegations.

Blackbaud, Inc. filed an 8-K reporting the settlement of a multi-state investigation into a 2020 security incident where a cyber criminal exfiltrated a subset of data. The company agreed to pay $49.5 million to 49 states and D.C., comply with HIPAA and state data breach laws, and improve cybersecurity programs. The California AG investigation remains unresolved.

Norwich University notified the NH Attorney General of a ransomware attack on its third-party provider, Blackbaud. The attack occurred between Feb 7 and May 20, 2020. Norwich discovered the scope of impacted data (SSN, financial, health info) for 7 NH residents on Feb 8, 2021. Blackbaud paid a ransom and confirmed data destruction. Norwich provided credit monitoring to affected individuals.

Wayne State Foundation notified New Hampshire AG of a ransomware attack on third-party provider Blackbaud. The attack occurred between Feb 7 and May 20, 2020. WSF discovered 2 NH residents potentially impacted via SSN/DOB in the database. Blackbaud paid ransom and confirmed data destruction. WSF offered 1 year of credit monitoring.

BLACKBAUD INC filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-373). The register records the breach as discovered on February 7, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

BLACKBAUD INC filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-361). The register records the breach as discovered on February 7, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.