Blackbaud, Inc. has recently been involved in a legal matter with the State of California, resulting in a Final Judgment and Permanent Injunction. The judgment addresses various aspects related to the company's security practices and data protection. One of the key definitions in the judgment is the "2020 Data Breach," which refers to an incident publicly announced by Blackbaud on July 16, 2020, involving unauthorized access to their network.
The judgment outlines specific requirements for Blackbaud to comply with, including the implementation of a comprehensive Information Security Program, breach response and notification procedures, and training requirements. Additionally, the company is mandated to maintain safeguards for personal and protected health information, as well as specific technical controls such as network segmentation, risk assessment, and intrusion detection and prevention tools.
Moreover, the judgment emphasizes the importance of assessment and reporting requirements, as well as document retention related to data security. It also addresses monetary provisions, release of liability, and enforcement mechanisms.
This legal development comes as Blackbaud continues to navigate the aftermath of the 2020 data breach. It reflects a heightened focus on data protection and security measures, aligning with the evolving regulatory landscape and the increasing scrutiny of companies' handling of sensitive information. The market has reacted to these announcements by moving the company's shares -0.5% to a price of $76.2. For more information, read the company's full 8-K submission here.
