Blackbaud

2020 ransomware breach of donor data; FTC order, USD 3M SEC and USD 49.5M states

Attackers used a customer's credentials to enter Blackbaud's network in a ransomware attack it discovered in May 2020 and disclosed in July 2020,, stayed undetected over three months, and exfiltrated unencrypted data including Social Security and bank account numbers of millions of consumers. Blackbaud initially said such data was not taken; the FTC ordered it in 2024 to delete unneeded data and improve security.