The SEC charged Blackbaud in March 2023 because employees learned within days that an attacker had taken donors' bank account and Social Security data, but the people responsible for public disclosures were not told. A quarterly report in August 2020 then described such risk as hypothetical. The company paid a 3 million dollar penalty.
What the SEC said
Blackbaud provides donor data software to nonprofits, and its 2020 ransomware attack affected more than 13,000 customers. On 16 July 2020 the company stated publicly that the attacker had not obtained bank account information or Social Security numbers.
The SEC found that within days of that statement, employees learned the attacker had in fact accessed and taken that data. Those employees did not inform senior management responsible for public disclosures, because the company's disclosure controls had failed. The quarterly report filed in August 2020 left out the true scope.
The company agreed to a 3 million dollar civil penalty and to cease and desist, without admitting or denying the findings.
The process failure, not the technical one
This case is about information flow. The technical team had the facts. The disclosure team wrote the words. Nothing connected them quickly enough.
That is a common gap. Engineers learn details at night and in chat threads, and a drafted statement is based on whatever was true when it was written.
A fix that engineers can own
- Name a single incident record as the source of truth for scope, updated as facts change.
- Require a timestamped scope update to be sent to legal and disclosure owners whenever the data types involved change.
- Before any public statement, require a named engineer to confirm in writing that each factual claim still holds.
- Re-verify claims already made when new findings arrive, and correct them early.
Careful wording helps
Statements made early in an incident should say what is known and what is still being investigated. A flat denial that a data type was taken is risky if the investigation is incomplete. Phrases like "at this time we have not identified" are only honest if the search was really done.
Practice it
Add a disclosure step to your incident tabletop. Run a scenario where the scope grows after a statement is made, and see whether the correction reaches legal in an hour. Safeguard's compliance and evidence automation can keep incident evidence organized, but deciding what to say publicly stays with your counsel and executives.
Roles to assign before an incident
Name a scribe who keeps the incident record, a fact checker who confirms each claim before release, and a liaison who carries scope changes to legal in writing. Write the three names into the incident plan with backups. People under pressure fall back on whatever was agreed in advance, so agree it early and rehearse it with the executives who sign public statements.
Quick check
Did the SEC say Blackbaud caused the ransomware attack?
No. The charges concerned misleading disclosures and failed disclosure controls, not the attack itself.
What was the penalty?
3 million dollars, according to the SEC press release, without Blackbaud admitting or denying the findings.
Sources
Last reviewed: 19 October 2026.
