Penalty Amount
$49,500,000
Blackbaud, a cloud company providing donor management software, experienced a 2020 data breach exposing personal information of millions of donors through its nonprofit customers. A multistate investigation found Blackbaud failed to implement adequate data security and delayed breach notifications. As a result, Blackbaud agreed to pay $49.5 million and overhaul its security practices.
Blackbaud must pay $49.5 million to the states, implement and maintain incident response plans, enhance security measures including encryption and monitoring, undergo third-party assessments for seven years, and discontinue misrepresentations about data safety.
In-house legal teams should review all vendor and data processing agreements with cloud service providers and SaaS vendors, particularly those handling sensitive donor, customer, or constituent data. Focus on clauses governing data security obligations (e.g., specific security frameworks, encryption, access controls), breach notification requirements (including timelines and content), audit and inspection rights, indemnification for data breaches, and limitations of liability. Given the findings of inadequate security and delayed notification, contracts should be amended to include more prescriptive security controls, shorter notification windows (e.g., 72 hours), mandatory reporting of security audits, and clear remedies for non-compliance. Additionally, review customer agreements to ensure robust data protection commitments are flowed down to end-users.
Entity
Blackbaud
Industry
TechnologyOfficial Press Release
https://ag.ny.gov/press-release/2023/attorney-general-james-and-multistate-coalition-secure-495-million-cloud-company
blackbaud avc ny
https://ag.ny.gov/sites/default/files/settlements-agreements/blackbaud-avc-ny.pdf
blackbaud impacted ny list
https://ag.ny.gov/sites/default/files/2023-10/blackbaud-impacted-ny-list.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Blackbaud"
"$49.5 million"
"state consumer protection laws, breach notification laws, and HIPAA"
"failed to implement reasonable data security and fix known security gaps"
"neglected to provide its customers with timely, complete, or accurate information regarding the breach"
$6.8M
California Attorney General Rob Bonta announced a $6.75 million settlement with software company Blackbaud over a 2020 data breach that exposed consumers' personal information including Social Security numbers, bank account details, and medical data. Blackbaud was found to have inadequate data security practices, failed to timely and accurately notify impacted individuals of the breach, and made misleading public disclosures about the breach and its pre-breach security measures. The settlement requires Blackbaud to pay penalties and implement enhanced data security and breach notification protocols.
$49.5M
Blackbaud, a software company, experienced a ransomware attack in 2020 that exposed sensitive personal information, including protected health data, due to inadequate security practices and delayed breach notification. A multistate investigation resulted in a $49.5 million settlement, requiring Blackbaud to enhance data security, implement breach response plans, and undergo third-party assessments.
$240K
The New York Attorney General investigated a group of debt buyers for filing foreclosure actions seeking payment of long-expired mortgage debts. The companies agreed to pay $240,000 in penalties and more than $242,000 in consumer restitution, stop seeking payment of time-barred debts, and amend claims in pending foreclosure cases.
$240K
New York Attorney General Letitia James reached an agreement with debt buyers that allegedly filed foreclosure lawsuits seeking payment on expired mortgage debt. The companies must pay $240,000 in penalties and more than $242,000 in restitution, and stop seeking expired payments in ongoing and future cases.
$6.0M
The New York Attorney General secured disgorgement settlements totaling $5,975,861 from four promoters of NovaTech and AWS Mining over fraudulent investment claims and an illegal pyramid scheme. The promoters were permanently banned from the securities, commodities, and cryptocurrency industries; the Attorney General separately asked the court to order NovaTech’s founders to pay $1.3 billion, which was not yet an order.
$98K
New York Attorney General Letitia James secured a settlement after T-Mobile raised prices on plans it had advertised with a promise that prices would never change. T-Mobile must offer affected customers refunds and other benefits, honor price guarantees through at least 2029 for customers who remain, clearly disclose limitations on future guarantees, and pay New York $98,000.