Blackbaud settles with FTC after that IT breach exposed millions of people's info

In 2020 attackers breached Blackbaud, stayed undetected for months, exfiltrated files containing sensitive personal data for millions of consumers, and extorted the company (which allegedly paid a ransom); subsequent regulatory actions (FTC, SEC, and state AG settlements) required Blackbaud to delete unnecessary backups, adopt stronger data retention and security controls (encryption, MFA, DLP, pen testing), and address misleading breach notifications.