📋 Tender Overview
The Securities and Exchange Commission announced that Blackbaud Inc. a South Carolina-based public company that provides donor data management software to non-profit organizations agreed to pay 3 million to settle charges for making misleading disclosures about a 2020 ransomware attack that impacted more than 13000 customers.The SECs order finds that on July 16 2020 Blackbaud announced that the ransomware attacker did not access donor bank account information or social security numbers. Within days of these statements however the companys technology and customer relations personnel learned that the attacker had in fact accessed and exfiltrated this sensitive information. These employees did not communicate this information to senior management responsible for its public disclosure because the company failed to maintain disclosure controls and procedures. Due to this failure in August 2020 the company filed a quarterly report with the SEC that omitted this material information about the scope of the attack and misleadingly characterized the risk of an attacker obtaining such sensitive donor information as hypothetical.As the order finds Blackbaud failed to disclose the full impact of a ransomware attack despite its personnel learning that its earlier public statements about the attack were erroneous said David Hirsch Chief of the SEC Enforcement Divisions Crypto Assets and Cyber Unit. Public companies have an obligation to provide their investors with accurate and timely material information Blackbaud failed to do so.The SECs order finds that Blackbaud violated Sections 17a2 and 17a3 of the Securities Act of 1933 and Section 13a of the Securities Exchange Act of 1934 and Rules 12b-20 13a-13 and 13a-15a thereunder. Without admitting or denying the SECs findings Blackbaud agreed to cease and desist from committing violations of these provisions and to pay a 3 million civil penalty.The SECs investigation was conducted by Brent Wilner and supervised by Diana Tani Carolyn Welshhans and Mr. Hirsch. The SEC appreciates the assistance of the Federal Trade Commission and the Offices of the Attorneys General for the States of Indiana and Vermont.
