FTC orders Blackbaud to boost security after massive data breach

Blackbaud suffered a May 2020 ransomware attack that exposed sensitive data for millions of individuals (including banking information, social security numbers, and plaintext credentials); the company paid a 24 BTC ransom and has since faced regulatory enforcement and civil litigation. The FTC, SEC, and a coalition of state attorneys general cited inadequate security controls, poor retention practices, and misleading disclosures, resulting in mandatory security improvements, fines and settlements (including a $3M SEC settlement and a $49.5M multi-state settlement).