Indiana lands $3.6M in national settlement of Blackbaud data breach case

Fundraising software company Blackbaud agreed Thursday to pay $49.5 million to settle claims brought by the attorneys general of 49 states and Washington, D.C., related to a 2020 data breach that exposed sensitive information from 13,000 not-for-profits.

Health information, Social Security numbers and the financial information of donors or clients of the not-for-profits, universities, hospitals and religious organizations that the company serves was the type of data that was exposed in the breach, according to Indiana Attorney General Todd Rokita, who co-led the investigation with Vermont.

Indiana will receive almost $3.6 million under the terms of the settlement, the most of any state, Rokita’s office said.

Blackbaud, which offers software for fundraising and data management to not-for-profits, first publicly acknowledged that an outside actor had gained access to its data on July 16, 2020, but downplayed the extent and sensitivity of the information that had been stolen, the attorneys general said. More than a million files were exposed in the breach.

The company paid the intruder a ransom in exchange for deleting the data.

Blackbaud agreed to strengthen its data security practices, improve customer notification in the event of another breach and to have an outside party assess its compliance with the terms of the settlement for seven years, the settlement said.

The company did not admit any wrongdoing under the terms of the agreement. Blackbaud said in a statement that it expected to pay the full settlement amounts in October.

In March, the U.S. Security’s and Exchange Commission said it settled charges against Blackbaud for misleading investors about the nature of the information that was stolen. After initially saying that bank information and Social Security numbers were not accessed in the breach, employees of the company found that it had been but failed to notify senior leaders, the SEC said.

The company agreed to pay a $3 million fine to the SEC but did not admit wrongdoing.