BLACKBAUD INC

Previous wording

We are supplementing Item 1A. Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2023, as filed with the Securities and Exchange Commission on February 21, 2024 (the “Annual Report”). The following risk factors should be read in conjunction with the risk factors set forth in that Annual Report.

Current wording

We are supplementing Item 1A. Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2023, as filed with the Securities and Exchange Commission on February 21, 2024 (the “Annual Report”). The following risk factor should be read in conjunction with the risk factors set forth in that Annual Report.

Previous wording

As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack. Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment that affected over 13,000 customers. Based on the nature of the incident, our research and third party (including law enforcement) investigation we believe that no data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly. However, our investigation into the Security Incident remains ongoing and may provide additional information.

Current wording

As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack. Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment that affected over 13,000 customers. Based on the nature of the incident, our research and third party (including law enforcement) investigation we believe that no data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly.

Previous wording

To date, we have received approximately 260 specific requests from customers for reimbursement of expenses incurred by them related to the Security Incident, all of which have been fully resolved and closed or are inactive and are considered by us to have been abandoned by the customers. We have also received approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident, none of which resulted in claims submitted to us and are considered by us to have been abandoned by the customers. We have also received notices of proposed claims on behalf of a number of U.K. data subjects, which we are reviewing. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and certain insurance companies have filed subrogation claims in court, of which three cases remain active and unresolved. In addition, presently, we are a defendant in putative consumer class action cases in U.S. federal courts (most of which have been consolidated under multi district litigation to a single federal court) and in Canadian courts alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. On May 14, 2024, the Court issued a memorandum opinion and order (1) denying the multi district litigation plaintiffs' motion for class certification because of the plaintiffs' failure to meet their burden of proof as to ascertainability, (2) granting our motion to exclude the multi district litigation plaintiffs' expert on the issue of ascertainability, and (3) denying the multi district litigation plaintiffs' motion to exclude our expert on the issue of ascertainability. Further, the Court denied as moot all other pending motions. On May 28, 2024, the plaintiffs filed a petition for permission to appeal under Rule 23(f) of the Federal Rules of Civil Procedure with the Fourth Circuit Court of Appeals (the “Fourth Circuit”) and we subsequently filed an opposition to such petition. On July 30, 2024, the Fourth Circuit denied the plaintiffs' petition. This litigation remains ongoing. We are subject to pending governmental actions or investigations by the U.S. Department of Health and Human Services, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada. (See Note 9 to our unaudited, condensed consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.)

Current wording

To date, we have received approximately 260 specific requests from customers for reimbursement of expenses incurred by them related to the Security Incident, all of which have been fully resolved and closed or are inactive and are considered by us to have been abandoned by the customers. We have also received approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident, none of which resulted in claims submitted to us and are considered by us to have been abandoned by the customers. We have also received notices of proposed claims on behalf of a number of U.K. data subjects, which we are reviewing. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and certain insurance companies have filed subrogation claims in court, of which two cases remain active and unresolved. In addition, presently, we are a defendant in putative consumer class action cases in U.S. federal courts (most of which have been consolidated under multi district litigation to a single federal court) and in Canadian courts alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. On May 14, 2024, the Court issued a memorandum opinion and order (1) denying the multi district litigation plaintiffs' motion for class certification because of the plaintiffs' failure to meet their burden of proof as to ascertainability, (2) granting our motion to exclude the multi district litigation plaintiffs' expert on the issue of ascertainability, and (3) denying the multi district litigation plaintiffs' motion to exclude our expert on the issue of ascertainability. Further, the Court denied as moot all other pending motions. On May 28, 2024, the plaintiffs filed a petition for permission to appeal under Rule 23(f) of the Federal Rules of Civil Procedure with the Fourth Circuit Court of Appeals (the “Fourth Circuit”), and we subsequently filed an opposition to such petition. On July 30, 2024, the Fourth Circuit denied the plaintiffs' petition. This litigation remains ongoing. We are subject to pending governmental actions or investigations by the U.S. Department of Health and Human Services, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada. (See Note 9 to our unaudited, condensed consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.)

Previous wording

As previously disclosed, on June 13, 2024, we agreed to a Final Judgment and Permanent Injunction with the Attorney General of the State of California (the "Final Judgment") relating to the Security Incident. This settlement fully resolved the last remaining U.S. state attorney general investigation into the Security Incident. Under the terms of the settlement, we agreed to comply with applicable laws; not to make misleading statements related to our data protection, privacy, security, confidentiality, integrity, breach notification requirements, and similar matters; and to implement and improve certain cybersecurity programs and tools. The terms of the settlement with California are generally consistent with those to which we agreed in settling with the other 49 state Attorneys General and the District of Columbia on October 5, 2023, as discussed below. As part of the settlement, we also agreed to pay a total of $6.8 million to the State of California. This amount was fully accrued as a contingent liability in the Company's financial statements as of March 31, 2024 and June 30, 2024, and subsequently paid in the third quarter of 2024. By agreeing to the Final Judgment, Blackbaud has denied wrongdoing or liability of any kind. Nothing contained in the Final Judgment is intended to be, and shall not in any event be construed or deemed to be, an admission or concession or evidence of any liability or wrongdoing whatsoever on the part of Blackbaud or any fact or violation of law, rule, or regulation. For more information, see the Final Judgment and Permanent Injunction of the State of California, County of San Diego that was furnished as Exhibit 99.1 to our Current Report on Form 8-K filed with the SEC on June 14, 2024.

Current wording

On June 13, 2024, we agreed to a Final Judgment and Permanent Injunction with the Attorney General of the State of California (the "California Judgment") relating to the Security Incident. This settlement fully resolved the last remaining U.S. state attorney general investigation into the Security Incident. Under the terms of the settlement, we agreed to comply with applicable laws; not to make misleading statements related to our data protection, privacy, security, confidentiality, integrity, breach notification requirements, and similar matters; and to implement and improve certain cybersecurity programs and tools. The terms of the settlement with California are generally consistent with those to which we agreed in settling with the other 49 state Attorneys General and the District of Columbia on October 5, 2023, as discussed below. As part of the settlement, we also agreed to pay a total of $6.8 million to the State of California. This amount was fully accrued as a contingent liability in the Company's financial statements as of March 31, 2024 and June 30, 2024, and subsequently paid in the third quarter of 2024. Nothing contained in the California Judgment is intended to be, and shall not in any event be construed or deemed to be, an admission or concession or evidence of any liability or wrongdoing whatsoever on the part of Blackbaud or any fact or violation of law, rule, or regulation. For more information, see the Final Judgment and Permanent Injunction of the State of California, County of San Diego that was furnished as Exhibit 99.1 to our Current Report on Form 8-K filed with the SEC on June 14, 2024.

Previous wording

As noted above, the terms of the Final Judgment, FTC Order, the Attorneys General Administrative Orders and our settlement with the SEC require that we implement and maintain certain processes and programs and comply with certain legal requirements related to cybersecurity and data protection. Any future regulatory investigation or litigation settlements may also contain such requirements. Effectively implementing, monitoring and updating these requirements is expected to be expensive and time-consuming over an extended period. Our failure to do so in accordance with the terms of our agreements with FTC, the Attorneys General and with the SEC, and possibly others, could expose us to additional material liability under the terms of the Administrative Orders, the SEC settlement, or otherwise.

Current wording

As noted above, the terms of the California Judgment, FTC Order, the Attorneys General Administrative Orders and our settlement with the SEC require that we implement and maintain certain processes and programs and comply with certain legal requirements related to cybersecurity and data protection. Any future regulatory investigation or litigation settlements may also contain such requirements. Effectively implementing, monitoring and updating these requirements has been, and is expected to be over an extended period of time, expensive and time-consuming. Our failure to do so in accordance with the terms of our agreements with FTC, the Attorneys General and with the SEC, and possibly others, could expose us to additional material liability under the terms of the Administrative Orders, the SEC settlement, or otherwise.

Previous wording

We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. It is reasonably possible that our estimated or actual losses may change in the near term for those matters and be materially in excess of the amounts accrued. Certain governmental authorities are seeking to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations.

Current wording

We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. It is reasonably possible that our estimated or actual losses may change in the near term for those matters and be materially in excess of the amounts accrued. Certain governmental authorities have imposed, and others may in the future impose, undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which have materially increased our data security costs or otherwise required us to alter how we operate our business, and could further do so in the future. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations.

Previous wording

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident. For example, for the three and six months ended June 30, 2024, we incurred net pre-tax expenses of $1.8 million and $12.1 million, respectively, related to the Security Incident, which included $1.8 million and $5.1 million, respectively, for ongoing legal fees and additional accruals for loss contingencies of $0.0 million and $7.0 million, respectively. During the six months ended June 30, 2024, we had cash outlays of $5.8 million related to the Security Incident for ongoing legal fees. For full year 2023, we currently expect pre-tax expenses of approximately $5.0 million to $10.0 million and cash outlays of approximately $8.0 million to $13.0 million for ongoing legal fees related to the Security Incident. Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage in the first quarter of 2022. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgments) or all types of claims that may arise in connection with the Security Incident, which could materially and adversely affect our liquidity and results of operations. (See Note 9 to our unaudited, condensed consolidated financial statements in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under the 2024 Credit Facilities, we may be forced to renegotiate or obtain a waiver under the 2024 Credit Facilities and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due.

Current wording

contingencies of $6.8 million. During the nine months ended September 30, 2024, we had cash outlays of $15.1 million related to the Security Incident for ongoing legal fees and the $6.8 million paid during the third quarter of 2024 related to our settlement with the Attorney General of the State of California. For full year 2023, we currently expect pre-tax expenses of approximately $5.0 million to $10.0 million and cash outlays of approximately $8.0 million to $13.0 million for ongoing legal fees related to the Security Incident. Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage in the first quarter of 2022. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgments) or all types of claims that may arise in connection with the Security Incident, which could materially and adversely affect our liquidity and results of operations. (See Note 9 to our unaudited, condensed consolidated financial statements in this report.) If any such fines, penalties or judgments were great enough that we could not pay them through funds generated from operating activities and/or cause a default under the 2024 Credit Facilities, we may be forced to renegotiate or obtain a waiver under the 2024 Credit Facilities and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due.