{
  "id": "case-sec-blackbaud-ransomware",
  "slug": "sec-v-blackbaud-ransomware-misrepresentation",
  "title": "SEC v. Blackbaud, Inc. (Misleading Ransomware Disclosure)",
  "summary": "Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.",
  "case_number": "SEC Release No. 33-11165",
  "court": "U.S. Securities and Exchange Commission",
  "district": "SEC Administrative Proceedings",
  "country": "United States",
  "opened_at": "2023-03-09",
  "status": "settled",
  "victim_sector": "Cloud Software & Non-Profit Technology",
  "victim_country": "United States",
  "loss_amount_usd": 3000000,
  "loss_amount_note": "SEC civil money penalty of $3 million to resolve disclosure controls violations.",
  "first_seen_at": "2020-05-14T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "revil-sodinokibi",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1486",
      "evidence_excerpt": "Ransomware adversary gained access to Blackbaud legacy hosted environment, exfiltrating data and encrypting client database files before being stopped by security staff.",
      "evidence_locator": "SEC Order Instituting Cease-and-Desist Proceedings \u00b6 8, Page 3",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "SEC Order: In the Matter of Blackbaud, Inc.",
      "source_url": "https://www.sec.gov",
      "technique_name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "technique_id": "T1567",
      "evidence_excerpt": "Threat actor exfiltrated unencrypted database backups containing bank routing numbers and Social Security numbers belonging to donor organizations.",
      "evidence_locator": "SEC Order Instituting Cease-and-Desist Proceedings \u00b6 12, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "SEC Order: In the Matter of Blackbaud, Inc.",
      "source_url": "https://www.sec.gov",
      "technique_name": "Exfiltration Over Web Service",
      "tactic": "Exfiltration"
    }
  ],
  "events": [
    {
      "event_type": "incident",
      "event_date": "2020-05-14",
      "description": "Ransomware intrusion detected in Blackbaud private cloud environment."
    },
    {
      "event_type": "sec_filing",
      "event_date": "2020-08-04",
      "description": "Blackbaud files Form 10-Q omitting that unencrypted bank details and SSNs were exfiltrated."
    },
    {
      "event_type": "settlement",
      "event_date": "2023-03-09",
      "description": "SEC imposes $3 million fine for inadequate disclosure controls and misleading statements."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Cloud Software & Non-Profit Technology infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.",
    "blast_radius": "Resulted in $3,000,000 in documented financial liabilities. SEC civil money penalty of $3 million to resolve disclosure controls violations.",
    "kill_chain": [
      {
        "phase": "Phase 1: Exfiltration",
        "title": "Encrypted Cloud Data Exfiltration",
        "description": "Threat actor exfiltrated unencrypted database backups containing bank routing numbers and Social Security numbers belonging to donor organizations.",
        "technical_artifacts": [
          "T1567",
          "Exfiltration Over Web Service"
        ],
        "mitre_technique_id": "T1567"
      },
      {
        "phase": "Phase 2: Impact",
        "title": "Operational Disruption or Extortion Detonation",
        "description": "Ransomware adversary gained access to Blackbaud legacy hosted environment, exfiltrating data and encrypting client database files before being stopped by security staff.",
        "technical_artifacts": [
          "T1486",
          "Data Encrypted for Impact"
        ],
        "mitre_technique_id": "T1486"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Cloud Software & Non-Profit Technology infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}