Blackbaud To Face Data Breach Class Action Lawsuit, Judge Rules

By Christina Spicer | July 6, 2021

Category: Data Breach

(Photo Credit: Pavel Kapysh/Shutterstock)

Blackbaud, Inc will face claims it failed to adequately prepare for and deal with a data breach and ransomware attack that exposed the personal and health information of millions across the globe.

U.S. District Judge Julianna Michelle Childs rejected the international cloud computing software company’s plea for dismissal of multiple consolidated class action lawsuits filed in the wake of the data breach. Blackbaud argued that the plaintiffs had failed to allege any injuries stemming from the breach, pinning their contentions on a third-party investigation into the ransomware attack that they said showed no credit card data had been stolen.

Pointing out that the investigation was narrow and Blackbaud claimed other aspects of it were incorrect, Judge Childs refused to dismiss the class action allegations. In her order, she also noted that Blackbaud’s statements to the financial regulators and its own clients contained contradictory information.

Further, “given Blackbaud’s lack of transparency about the extent of the ransomware attack, it is more than plausible that additional information such as contact information, SSNs, and financial information that could be used for spam, phishing, or other forms of fraud was accessed during the ransomware attack,” noted Judge Childs’ order.

Blackbaud sells cloud software products to a variety of schools, churches, nonprofit organizations and charitable foundations. The company claims to have “millions of users in 110+ countries.”

Blackbaud was hit by ransomware in a 2020 cyberattack that resulted in thieves purported removing a copy of a subset of data from Blackbaud’s self-hosted environment.

While not listing exactly what information was accessed, Blackbaud reported that no credit card information, no bank account information and no Social Security numbers were accessed. The ransomware issue allegedly ended when Blackbaud paid the cyber criminals the amount of money they demanded.

Though Blackbaud told customer that no financial information had been compromised, it urged them to be on the lookout for suspicious activity, leading some to believe that the secretive company knew more. In addition, consumers alleged in multiple class action lawsuits that Blackbaud had failed to secure its data from ransomware attacks.

The claims were consolidated in South Carolina federal court and the multidistrict litigation includes more than 30 plaintiffs from 20 states that allege the Blackbaud data breach exposed personal, educational, and health information.

Was your personal information exposed in the Blackbaud data breach? We want to hear from you! Tell us about your experience in the comment section below.

The plaintiffs are represented by Motley Rice LLC, DiCello Levitt Gutzler LLC, Susman Godfrey LLP, Whitfield Bryson LLP and Keller Rohrback LLP.

The Blackbaud Data Breach Class Action Lawsuit is Clayton et al. v. Blackbaud, Case No. 3:21-cv-01058, in the U.S. District Court for the District of South Carolina, Columbia Division.