What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2020-11-03 compared with 2020-08-04 · 49 added, 28 removed, 25 unchanged (75% of the section changed)

8 unchanged sentences

Governmental authorities have taken, and continue to take, countermeasures to slow the outbreak, including shelter-in-place and business closure orders and large-scale restrictions on travel.

Furthermore, because the pandemic is a rapidly evolving situation, we cannot anticipate with any certainty the length, scope or severity of such restrictions in the jurisdictions in which we operate.

Certain vertical markets we serve are especially vulnerable to the global business disruption.

For example, many arts and cultural organizations, including museums, zoos, performing arts centers and theaters, among others, have had to cancel events or have seen a significant decline in attendance due to COVID-19.

Furthermore, because the pandemic is a rapidly evolving situation, we cannot anticipate with certainty the length, scope or severity of such restrictions in the jurisdictions in which we operate.

Certain vertical markets we serve are especially vulnerable to the ongoing global business disruption.

• Many arts and cultural organizations, including museums, zoos, performing arts centers and theaters, among others, have had to cancel events or have seen a significant decline in attendance due to COVID-19.

Many of these organizations have also suspended their operations temporarily.

In addition, we believe that a number of K-12 private schools, that would ordinarily consider purchasing our cloud solutions for the 2020-2021 academic school year, have delayed their expenditure decisions due to the uncertainty of COVID-19.

We expect that COVID-19 will impact all of our vertical markets across all of our geographies to some degree, but the significance and duration of the impact on our business cannot be determined at this time due to numerous uncertainties, including the ultimate geographic spread of the disease, the duration of the outbreak, travel restrictions and business closures, the effectiveness of actions taken to contain the disease and other unforeseeable consequences.

• We believe that a number of K-12 private schools, that would have ordinarily considered purchasing our cloud solutions for the 2020-2021 academic school year, have delayed their expenditure decisions due to the uncertainty of COVID-19.

• A number of our nonprofit customers have also been negatively impacted by the postponement or cancellation of mass-participation events, such as marathons and other endurance sporting events, galas, auctions and other fundraisers.

We believe that COVID-19 has impacted and will continue to impact all of our vertical markets across all of our geographies to some degree, but the significance and duration of the impact on our business cannot be determined at this time due to numerous uncertainties, including the ultimate geographic spread of the disease, the duration of the outbreak, travel restrictions and business closures, the effectiveness of actions taken to contain the disease and other unforeseeable consequences.

This impact could include:

3 unchanged sentences

• reduced workforce availability and productivity due to working remotely using different technologies and potential health effects and concerns;

risks associated with our indebtedness (including available borrowing capacity, compliance with financial covenants and ability to refinance or repay indebtedness on favorable terms);

the adequacy of our cash flow and earnings and other conditions which may affect our liquidity;

• risks associated with our indebtedness (including available borrowing capacity, compliance with financial

Third Quarter 2020 Form 10-Q

Blackbaud, Inc.

covenants and ability to refinance or repay indebtedness on favorable terms);

• the adequacy of our cash flows and earnings and other conditions that may affect our liquidity;

• disruptions to our technology network and other critical systems;

2 unchanged sentences

and global economies and may materially adversely impact our business, financial condition and results of operations.

Second Quarter 2020 Form 10-Q

Blackbaud, Inc.

If the security of our software is breached, we fail to securely collect, store and transmit customer information, or we fail to safeguard confidential donor data, we could be exposed to liability, litigation, penalties and remedial costs and our reputation and business could suffer.

Fundamental to the use of our solutions is the secure collection, storage and transmission of confidential donor and end user data and transaction data, including in our payment services.

Despite the network and application security, internal control measures, and physical security procedures we employ to safeguard our systems, we may still be vulnerable to a security breach, intrusion, loss or theft of confidential donor data and transaction data, which may harm our business, reputation and future financial results.

Like many major businesses, we are, from time to time, a target of cyber-attacks and phishing schemes, and we expect these threats to continue.

Because of the numerous and evolving cybersecurity threats, including advanced and persistent cyber-attacks, phishing and social engineering schemes, used to obtain unauthorized access, disable or degrade systems have become increasingly more complex and sophisticated and may be difficult to detect for periods of time, we may not anticipate these acts or respond adequately or timely.

Despite the network, application and physical security procedures and internal control measures we employ to safeguard our systems, we may still be vulnerable to a security breach, intrusion, loss or theft of confidential donor data and transaction data, which may harm our business, reputation and future financial results.

Furthermore, our increased reliance on remote access to information systems and global disruptions in response to COVID-19, as described above, increase our exposure to potential cybersecurity incidents.

Like many major businesses, we are, from time to time, a target of cyberattacks, phishing and social engineering schemes, such as the Security Incident (as described in Note 10 of the unaudited condensed consolidated financial statements in this report), and we expect these threats to continue, some of which may be successful to varying degrees.

Because the numerous and evolving cybersecurity threats used to obtain unauthorized access, disable, degrade or sabotage systems have become increasingly more complex and sophisticated, it may be difficult to anticipate these acts or to detect them for periods of time, as with the Security Incident, and we may be unable to respond adequately or timely.

As these threats continue to evolve and increase, we may be required to devote significant additional resources in order to modify and enhance our security controls and to identify and remediate any security vulnerabilities.

A compromise of our data security that results in customer or donor personal or payment card data being obtained by unauthorized persons could adversely affect our reputation with our customers and others, as well as our operations, results of operations, financial condition and liquidity and could result in litigation against us or the imposition of penalties.

We might be required to expend significant capital and other resources to further protect against security breaches or to rectify problems caused by any security breach, including notification under data privacy laws and regulations and expenses related to remediating our information security systems.

A compromise of our data security that results in customer or customer constituent personal or payment card data being obtained by unauthorized persons could adversely affect our reputation with our customers and others, as well as our operations, results of operations, financial condition and liquidity and could result in litigation against us or the imposition of fines and penalties.

We might be required to expend significant additional capital and other resources to rectify problems caused by a security breach, including notification under data privacy laws and regulations, and incur expenses related to remediating our information security systems.

Even though we carry cyber-technology insurance policies that may provide insurance coverage under certain circumstances, we might suffer losses as a result of a security breach that exceed the coverage available under our insurance policies or for which we do not have coverage.

A security breach and any efforts we make to address such breach could also result in a disruption of our operations, particularly our online sales operations.

Further, the existence of vulnerabilities, even if they do not result in a security breach, may harm client confidence and require substantial resources to address, and we may not be able to discover or remedy such security vulnerabilities before they are exploited, which may harm our business, reputation and future financial results.

On July 16, 2020, we contacted certain customers to inform them about a recent security incident.

Our communication to these customers included the information that in May 2020 we discovered and stopped a ransomware attack.

In a ransomware attack, cybercriminals attempt to disrupt the business by locking companies out of their own data and servers.

After discovering the attack, our cybersecurity team—together with independent forensics experts and law enforcement—successfully prevented the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelled them from our system with no significant disruption to our operations.

Prior to our locking the cybercriminal out of our system, the cybercriminal removed a copy of a subset of data from our self-hosted environment.

This incident did not involve solutions in our public cloud environment (Microsoft Azure, Amazon Web Services), nor did it involve the majority of our self-hosted environment.

Based on the nature of the incident, our research and third party (including law enforcement) investigation, we have no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly.

Most of our customers were not part of the incident.

The subset of customers who were part of this incident have been notified and supplied with additional information and resources.

Our investigation into the incident by our cybersecurity team and third-party forensic advisors remains ongoing.

It is expected that we will continue to experience increased costs related to our response to this incident and our efforts to further enhance our security measures.

In addition, it is possible that the incident may result in loss of customers and partners, harm our reputation, increased costs to maintain insurance coverage, devotion of substantial management time, litigation or regulatory enforcement, claims for indemnification obligations, future cybersecurity attacks and other potential liabilities.

Second Quarter 2020 Form 10-Q

The occurrence of actual cyber security events, such as the Security Incident, could magnify the severity of the adverse effects of future incidents on our business.

The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems can be difficult to detect for long periods of time and can involve difficult or prolonged assessment or remediation periods even once detected.

We, therefore, cannot assure you that all potential causes of past significant incidents, including the Security Incident, have been fully identified and remediated.

The steps we take may not be sufficient to prevent future significant incidents and, as a result, such incidents may occur again.

The Security Incident could have numerous adverse effects on our business.

As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack.

Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment.

Although the nature of the incident, our research and third party (including law enforcement)

Third Quarter 2020 Form 10-Q

Blackbaud, Inc.

investigation have provided no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly, our investigation into the Security Incident remains ongoing and may provide additional information.

To date, we have received approximately 160 claims from customers or their attorneys related to the Security Incident and are in the process of assessing what, if any, liability may exist pursuant to such claims.

Possible exposure could result from our customers’ costs and expenses associated with notifying their own constituents of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident.

In addition, to date, we have been named as a defendant in 23 putative consumer class action cases (17 in U.S.

federal courts, 4 in U.S.

state courts and 2 in Canadian courts) alleging harm from the Security Incident.

The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief.

To date, we also have received a consolidated, multi-state Civil Investigative Demand issued on behalf of 43 state Attorneys General and the District of Columbia relating to the Security Incident.

In addition, we have received communications, inquires and requests from the U.S.

Federal Trade Commission, the U.S.

Department of Health and Human Services, the Information Commissioner’s Office in the United Kingdom (the “ICO”) under the U.K.

Data Protection Act 2018, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada.

(See Note 10 to the unaudited, condensed consolidated financial statements included in this report.)

We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations.

Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that may not be covered by insurance.

Governmental authorities also may seek to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business.

Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations.

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident.

(See Note 10 to the unaudited, condensed consolidated financial statements included in this report.) Although we carry cyber-technology insurance designed to protect us against certain losses related to cybersecurity events, that insurance coverage may not be sufficient to cover all expenses or other losses (including fines) or all types of claims that may arise in connection with cyberattacks, security compromises and other related incidents.

Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all.

Future publicity or developments related to the Security Incident could have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties.

Third Quarter 2020 Form 10-Q

Blackbaud, Inc.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors