## Facts

- Blackbaud, Inc. provided software and data-hosting services to nonprofit customers that stored donor personal and financial information on Blackbaud’s systems.
- As early as February 2020, a threat actor infiltrated Blackbaud’s self-hosted environment and, by May 2020, exfiltrated backup files.
- Blackbaud discovered the incident on May 14, 2020, engaged outside cybersecurity and ransom-negotiation vendors, and paid a ransom in exchange for the attacker’s promise to delete exfiltrated data.
- On July 16, 2020, Blackbaud publicly disclosed the incident and notified affected customers, stating the attacker did not access donor bank account information or Social Security numbers.
- At the time of the July 16 statement, Blackbaud and its vendors had not analyzed the contents of the exfiltrated files beyond file names.
- Within days, customers reported that they had stored sensitive information with Blackbaud in unencrypted form; by July 21, 2020, customer service used a script acknowledging certain sensitive attachments and fields were not encrypted.
- By the end of July 2020, internal personnel learned the July 16 assurances about bank account and Social Security data were incorrect.
- The incident involved unauthorized access and exfiltration of over one million files relating to approximately 13,000 customers.
- On August 4, 2020, Blackbaud filed a Form 10‑Q describing the incident but omitting the information indicating sensitive bank account and Social Security data had been accessed and characterizing the risk of such exfiltration as hypothetical.
- In late September 2020, Blackbaud filed a Form 8‑K disclosing that the attacker had accessed unencrypted bank account and Social Security information.
- The SEC instituted settled administrative cease-and-desist proceedings; findings were made pursuant to Blackbaud’s offer of settlement.

## Issues

1. Whether Blackbaud made materially misleading statements or omissions in public communications and its Form 10‑Q about the scope of the ransomware attack and the sensitivity of the data accessed.
2. Whether Blackbaud failed to maintain disclosure controls and procedures reasonably designed to ensure material cyber-incident information known within the company was timely communicated to personnel responsible for SEC filings.

## Decision

- The SEC found violations of Securities Act § 17(a)(2) and (3).
- The SEC found violations of Exchange Act § 13(a) and Rules 12b‑20 and 13a‑13 based on materially misleading periodic reporting.
- The SEC found a violation of Exchange Act Rule 13a‑15(a) for inadequate disclosure controls and procedures.
- The SEC ordered Blackbaud to cease and desist from future violations of the cited provisions and rules.
- The SEC imposed a civil money penalty as part of the settlement and considered remedial measures as mitigating but not exculpatory.

## Legal Principles

- Public company disclosures about a known cyber incident must not omit material information about the incident’s scope and the nature of compromised data when the company has non-speculative information.
- Describing realized access to sensitive information as a hypothetical risk can be materially misleading in periodic reports.
- Securities Act § 17(a)(2)–(3) may be violated by negligent misstatements or omissions in connection with securities offerings or sales; scienter is not required.
- Exchange Act § 13(a) and Rules 12b‑20 and 13a‑13 require periodic reports to include material information necessary to make stated disclosures not misleading.
- Rule 13a‑15(a) requires disclosure controls and procedures that facilitate timely escalation of material information—including from IT and customer-facing personnel—to those responsible for disclosure decisions and SEC filings.

## Conclusion

The SEC concluded that Blackbaud’s cyber-incident disclosures were materially misleading because the company failed to timely reflect internal knowledge that unencrypted bank account and Social Security information had been accessed and instead framed that exposure as hypothetical in its Form 10‑Q; the SEC also found deficient disclosure controls and imposed a cease-and-desist order and civil penalty in a settled administrative action.


In re Blackbaud, Inc., Securities Act Release No. 11165, Exchange Act Release No. 97098 (SEC Mar. 9, 2023)