Blackbaud

Disclosed Jul 16, 2020Settled

Ransomware attack on donor software firm exposes nonprofit donor data

Blackbaud told customers in July 2020 that it had discovered and stopped a ransomware attack in May in which data was copied; it later said some unencrypted bank account and Social Security number fields may have been accessed. The SEC charged it with misleading disclosures.

What is known

People affected	Not stated in the sources we have
Disclosed	Jul 16, 2020
Discovered	May 2020
Attack	Ransomware
Data exposed	NamesAddressesFinancialSocial Security numbersCredentials and tokens
Sector	Tech · US
Status	Settled
Lawsuit or fine	$3M SEC settlement (2023) (about $3M)

Sources

SEC filingsec.gov

Blackbaud 8-K (September 29, 2020)

Regulatorsec.gov

SEC Charges Software Company Blackbaud Inc. for Misleading Disclosures About Ransomware Attack

Notices filed

TotalJul 16, 2020

ResearchCount not stated

Other breaches at Blackbaud

2020 ransomware breach of donor data; FTC order, USD 3M SEC and USD 49.5M statesRansomware exposed names, addresses, emails, phone numbers, Social Security numbers and financial details.RansomwareTechUSOct 7, 2020

History of this record

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Blackbaud