SEC Issues $3 Million Penalty Against Blackbaud For Misleading Cybersecurity Incident Disclosures

On March 9, software company Blackbaud agreed to pay $3 million to the SEC as a result of alleged misleading disclosures arising out of a 2020 data breach that involved customer bank account information and Social Security numbers. This order underscores again the importance of effective internal communication between data security and privacy personnel and senior management responsible for a company's public disclosures. In March 2022, the SEC proposed comprehensive rule changes to standardize and enhance disclosures relating to cybersecurity risk management (see our prior alert). As these proposals are expected to take effect soon, companies should continue to ensure that their disclosure policies and procedures meet regulatory guidelines.