Blackbaud settles SEC charges for $3M over misleading 2020 ransomware disclosure

BLACKBAUD INC

SEC order requires Blackbaud to cease-and-desist and pay $3M civil penalty for misleading statements about scope of 2020 data breach.
Attack exfiltrated 1M+ files from 13,000+ customers, including unencrypted bank account numbers and SSNs.
Blackbaud's Aug 2020 10-Q omitted that sensitive donor data was accessed, misleading investors.
Company lacked disclosure controls for cybersecurity incidents, violating Exchange Act Rule 13a-15(a).
Settlement resolves SEC investigation; Blackbaud neither admits nor denies findings.

This headline and bullets were generated automatically by deepseek-v4-flash:cloud@v2 from the public filing. Read the source on SEC.gov before relying on any specific claim. Not investment advice. See methodology for how this pipeline works.