Blackbaud Mulling Lawsuit after Paying Cybercriminals Ransom with Bitcoin



Blackbaud Mulling Lawsuit after Paying Cybercriminals Ransom with Bitcoin



Blackbaud is the premier provider of fundraising and financial services for nonprofits. The company was unfortunately hacked, and a trove of consumer data was put at risk by professional cybercriminals.

The Blackbaud team learned of the intrusion in May 2020. Law enforcement and forensic experts became involved in suspending and haltering the data. During the security break, the Blackbaud team was able to secure user access with encrypted files.

Before this, Blackbaud personnel noticed malicious activity that was occurring internally. The cybercriminals picked up that Blackbaud had closed the data breach, and now they wanted ransom to destroy internal files.

Upon discovery of the data breach, Blackbaud went ahead and paid the cybercriminals ransom money in Bitcoin to destroy the data. The company failed to disclose the amount they paid the criminals in ransom fees.

Consumer Subset Data


The criminals were able to obtain a copy of subset data from user activity. However, they did not get the rich treasure trove of consumer data like credit card numbers, bank account numbers, and social security numbers.

Blackbaud is listed on the NASDAQ as a publicly-traded company. Revenues for the year are $908.2 million, with a market cap of $2.7 billion. The stock price is competitive at $54.28; however, the stock price is down 30.8% for the year.

If the company considered the paid ransom a material fact for its financial health, the SEC would require the company to file form K-8. A spokesperson for Blackbaud said no such filing would be made or disclosed.

Ransomware Attacks


By stopping the ransomware attack, Blackbaud wants its customers to know that their data and online activity is safe and secure. Their data would not be disseminated or made available to the public. Blackbaud only paid the ransom in Bitcoin when the cybercriminals guaranteed that customers’ private data would not be discoverable on the internet and that such data would be destroyed.

For additional security, Blackbaud hired third-party experts to scout the internet and the dark web for any leaked discoverable customer data. So far, no treasure trove of customer data has been released to the public.

However, this has not stopped a new class-action lawsuit from disgruntled customers. Hackers made inroads into the Blackbaud system as early as February 7, 2020. Blackbaud did not discover the security breach until May 14, 2020. Finally, customers were not aware of the security breach until July 2020.

Class-Action Lawsuit


The new class-action lawsuit was filed in the United States District Court of South Carolina in Charleston. According to the plaintiff, William Allen, the security breach has brought irreparable harm to customers in the form of lost time to remedy the unsecured data loss and extra out-of-pocket expenses for identity theft monitoring.

Of course, a spokesperson for Blackbaud disagrees with the class-action lawsuit. The allegations of the lawsuit are unnecessary and unfounded. Any vulnerabilities in the system had been secured. Representatives for Blackbaud said that sensitive personal information like credit card numbers and social security numbers were not exposed.

Cybercriminals remained in contact with Blackbaud until June 18, 2020, but they were unable to access customer data since June 3, 2020. By June 25, 2020, third-party experts gave Blackbaud representatives the risk factors for customer data exposure.

To minimize risk, Blackbaud sent out notices to their customers that they should monitor their bank accounts, credit card accounts, and the opening of new lines of credit with their social security numbers. Private account information may have been compromised. It is a standard procedure to send out notices to customers in a ransomware security breach.

On the other hand, the lawsuit alleges that:


  • Blackbaud failed to notify customers of the data breach in a timely manner.

  • Blackbaud failed to secure the network to prevent ransomware attacks.

  • Employees did not properly monitor the network for secure communications.

  • Management did not train employees about ransomware attacks.

  • Representatives cannot assume that the cybercriminals destroyed subset data.



Besides these allegations, Blackbaud expects their customers to take the necessary precautions and pay for credit monitoring services with identity theft insurance with no private compensation from the company.

Allen hopes that the court finds Blackbaud negligent with the invasion of privacy, breach of contract, breach of implied contract, and violation of state security data breach statutes. The plaintiff would like Blackbaud to pay for seven years of identity theft services, real and putative damages, plus attorney fees.

Presently, there is no federal law covering damages for security breaches with consumer protection. North Carolina is considering a bill where companies must pay at least two years of identity theft protection for consumer data breaches.









Other Featured Posts


The Best Ways to Save Money in 2020

Take Advantage of the Discounts You've Earned! {random_image_1} Our readers have worked hard to provide for their immediate and extended family now and in the future. That's why taking advantage of the discounts they've earned is one ...

READ MORE

Billions of Assets Go Unclaimed Each Year!

If you have ever moved, changed jobs, filed a tax return, or had a relative pass away; there’s a good chance you have unclaimed assets. Unclaimed money consists of billions of dollars that have been abandoned at financial institut...

READ MORE

Settlement Opportunities For You and Your Family

If you have been injured by any of the following products, you may be entitled to compensation for your suffering. Each of the instances below allow for a free case evaluation: 1. Injury Settlements People get injured every ...

READ MORE

State By State Guide to Unclaimed Assets

Click on the state where your assets are most likely to live Alabama Alaska Arizona Arkansas California Colorado Connecticut Delaware District of Columbia Florida Georgia Hawaii Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana...

READ MORE