Last week, Alabama Attorney General Steve Marshall announced a 49-state settlement with software company Blackbaud for its deficient data security practices and response to a 2020 data breach that exposed the personal information of millions of consumers across the United States. Under the settlement, Blackbaud has agreed to overhaul its data security and breach notification practices and make a $49.5 million payment to the states. Alabama will receive $1.6 million from the settlement.
“Data breaches are becoming far too common as well-known tech companies are facing major security breaches that directly impact businesses, organizations and ultimately, consumers,” Marshall said in a press release. “While we constantly urge consumers to be vigilant with how and when they provide personal information, companies also need to take a serious look at their technology defenses. Consumers should feel confident when making a payment, donation, or providing sensitive personal information that their personal information will not end up on the dark web.”
Blackbaud provides software to various nonprofit organizations, including charities, higher education institutions, K-12 schools, healthcare organizations, religious organizations, and cultural organizations. Blackbaud’s customers use Blackbaud’s software to connect with donors and manage data about their constituents, including contact and demographic information, Social Security numbers, driver’s license numbers, financial information, employment and wealth information, donation history, and protected health information. This type of highly sensitive information was exposed during the 2020 data breach, which impacted over 13,000 Blackbaud customers and their respective consumer constituents.
The settlement resolves allegations that Blackbaud violated state consumer protection laws, breach notification laws, and HIPAA by failing to implement reasonable data security programs and remediate known security gaps, which allowed unauthorized persons to gain access to Blackbaud’s network, and then failing to provide its customers with timely, complete, or accurate information regarding the breach, as required by law. As a result of Blackbaud’s actions, notification to the consumers whose personal information was exposed was significantly delayed or never occurred at all insofar as Blackbaud downplayed the incident and led its customers to believe that notification was not required.
Under the settlement, Blackbaud has agreed to strengthen its data security and breach notification practices going forward, including:
- Prohibition against misrepresentations related to the processing, storing, and safeguarding of personal information; the likelihood that personal information affected by a security incident may be subject to further disclosure or misuse; and breach notification requirements under state law and HIPAA.
- Implementation and maintenance of incident and breach response plans to prepare for and more appropriately respond to future security incidents and breaches.
- Breach notification provisions that require Blackbaud to provide appropriate assistance to its customers and support customers’ compliance with applicable notification requirements in the event of a breach.
- Security incident reporting to the CEO and Board, enhanced employee training, and appropriate resources and support for cybersecurity.
- Personal information safeguards and controls requiring total database encryption and dark web monitoring.
- Specific security requirements with respect to network segmentation, patch management, intrusion detection, firewalls, access controls, logging and monitoring, and penetration testing.
- Third-party assessments of Blackbaud’s compliance with the settlement for 7 years.
Indiana and Vermont co-led the multistate investigation, assisted by the Executive Committee consisting of Alabama, Arizona, Florida, Illinois, and New York, and joined by Alaska, Arkansas, Colorado, Connecticut, Delaware, District of Columbia, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Washington, West Virginia, Wisconsin, and Wyoming.
The Securities and Exchange Commission (SEC) charged the company for making misleading disclosures concerning the data breach. In March, the SEC announced that the company had agreed to pay $3 million to settle the charges.
“As the order finds, Blackbaud failed to disclose the full impact of a ransomware attack despite its personnel learning that its earlier public statements about the attack were erroneous,” said David Hirsch, Chief of the SEC Enforcement Division’s Crypto Assets and Cyber Unit. “Public companies have an obligation to provide their investors with accurate and timely material information; Blackbaud failed to do so.”
