Maryland receives $820K as part of national data breach settlement

Listen to this article

Maryland will receive $820,156 as part of a nearly $50 million data breach settlement, the Maryland Attorney General announced Thursday.

Blackbaud, a software company headquartered in Charleston, South Carolina, settled with 49 states and the District of Columbia, excluding California, to resolve allegations that the company violated Maryland’s Consumer Protection Act and the  federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) when the company failed to protect consumers’ personal information during a 2020 data breach.

The breach affected thousands of nonprofit organizations nationwide, including 290 in Maryland.

The 49 states contended that Blackbaud downplayed the incident and either delayed or never provided notification to the consumers whose personal information was exposed.

Under the settlement, Blackbaud agreed to strengthen its data security and breach notification practices, including by developing incident and breach response plans, assisting customers with notification requirements in the event of a breach and encrypting its databases that contain consumers’ personal information.

According to the settlement, the $828,156 paid to Maryland will be used by the consumer protection division of the Attorney General’s Office for other consumer protection or privacy enforcement efforts or to defray the cost of litigation, among other purposes.

Attorney General Anthony Brown emphasized the importance of safeguarding consumers’ sensitive personal information.

“Adequate protection of sensitive personal information is critical to helping consumers avoid the painful experience of identity and financial theft,” Brown said in a news release. “Marylanders deserve assurances that their personal information will remain private and protected.”

Blackbaud, in addition to providing software to manage personal information data, protected health information for various nonprofit organizations, including charities, colleges, K-12 schools, and health care, religious and cultural organizations.