FTC Enters Consent Agreement With Blackbaud Following Major Data Breach

On February 1, the Federal Trade Commission (FTC or "the Commission") announced that it had reached a settlement with Blackbaud, a software company, resolving claims related to a 2020 data breach that resulted in the compromise of millions of consumers' personal information. The FTC alleged that Blackbaud failed to secure consumers' personal information by, among other things, failing to implement adequate encryption and data retention policies. The Commission further alleged that Blackbaud exacerbated the impact of the subsequent data breach by delaying its breach notifications and misrepresenting the scope and extent of the breach to affected customers. The FTC's proposed order requires that Blackbaud take numerous steps to bolster its information security practices, such as improving its data retention policies and implementing a formal information security program that includes such safeguards as multi-factor authentication, improved access controls, and mandatory