Ransomware Attack—SEC Charges Misleading Disclosures And Disclosure Control Failure—Again!

Last week, the SEC announced settled charges against Blackbaud, Inc., a provider of donor data management software to non-profit organizations, for misleading disclosures and disclosure control failures. According to the SEC, in May 2020, employees at the company discovered evidence of a ransomware attack. After an investigation, the company announced the incident and advised affected customers-specifying that sensitive donor data was not involved. But just a couple of weeks later, the SEC alleged, company personnel learned that the attacker had, in fact, accessed sensitive donor data for a number of customers-including bank account and social security numbers. But-you guessed it-it's disclosure controls again! The personnel with knowledge of the scope of the breach "did not communicate this to Blackbaud's senior management responsible for disclosures, and the company did not have policies or procedures in place designed to ensure they do so." As a result, the SEC