SEC v. Blackbaud, Inc. (Misleading Ransomware Disclosure)
Key Facts
- Legal Status: SETTLED in U.S. Securities and Exchange Commission.
- Primary Target Sector: Cloud Software & Non-Profit Technology.
- Documented Financial Loss: $3.0 million.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.
Root Cause & Infiltration Vector
Initial access established against Cloud Software & Non-Profit Technology infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.
Operational Impact & Financial Blast Radius
Resulted in $3,000,000 in documented financial liabilities. SEC civil money penalty of $3 million to resolve disclosure controls violations.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Threat actor exfiltrated unencrypted database backups containing bank routing numbers and Social Security numbers belonging to donor organizations.
Ransomware adversary gained access to Blackbaud legacy hosted environment, exfiltrating data and encrypting client database files before being stopped by security staff.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Cloud Software & Non-Profit Technology infrastructure.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Ransomware intrusion detected in Blackbaud private cloud environment.
Blackbaud files Form 10-Q omitting that unencrypted bank details and SSNs were exfiltrated.
SEC imposes $3 million fine for inadequate disclosure controls and misleading statements.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1486 | Data Encrypted for Impact Impact | "Ransomware adversary gained access to Blackbaud legacy hosted environment, exfiltrating data and encrypting client database files before being stopped by security staff." | SEC Order Instituting Cease-and-Desist Proceedings ¶ 8, Page 3 | reviewed |
| T1567 | Exfiltration Over Web Service Exfiltration | "Threat actor exfiltrated unencrypted database backups containing bank routing numbers and Social Security numbers belonging to donor organizations." | SEC Order Instituting Cease-and-Desist Proceedings ¶ 12, Page 4 | reviewed |