BLACKBAUD INC 10-Q

ITEM 1A. RISK FACTORS We are supplementing Item 1A. Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2021, as filed with the Securities and Exchange Commission on March 1, 2022 (the “Annual Report”). The following risk factors should be read in conjunction with the risk factors set forth in that Annual Report. Operational Risks The Security Incident has had, and may continue to have, numerous adverse effects on our business, results of operations, financial condition and cash flows. As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack. Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment. Based on the nature of the incident, our research and third party (including law enforcement) investigation we believe that no data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly. However, our investigation into the Security Incident remains ongoing and may provide additional information. To date, we have received approximately 260 Customer Reimbursement Requests and approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident (none of which have as yet been filed in court). In June 2022, we also received notice of a proposed claim on behalf of a number of U.K. data subjects, which we are reviewing. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and one insurance company has filed a subrogation claim in court. Customer and insurer subrogation claims generally seek reimbursement of their costs and expenses associated with notifying their own customers of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident. In addition, presently, we are a defendant in 19 putative consumer class action cases [17 in U.S. federal courts (which have been consolidated under multi district litigation to a single federal court) and 2 in Canadian courts] alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. To date, we also have received a consolidated, multi-state Civil Investigative Demand issued on behalf of 49 state Attorneys General and the District of Columbia and a separate Civil Investigative Demand from the office of the California Attorney General relating to the Security Incident. In addition, we are subject to pending governmental actions or investigations by the U.S. Federal Trade Commission, the U.S. Department of Health and Human Services, the SEC, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada. (See Note 10 to our unaudited, condensed consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.) Third Quarter 2022 Form 10-Q 49 Table of Contents Blackbaud, Inc. We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. For example, we have recorded approximately $5.0 million in aggregate liabilities for loss contingencies related to the Security Incident that we believe we can reasonably estimate as of September 30, 2022. Governmental authorities are likely to seek to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations. In addition, any legislative or regulatory changes adopted in reaction to the Security Incident or other companies’ data breaches could require us to make modifications to the operation of our business that could have an adverse effect and/or increase or accelerate our compliance costs. Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident. For example, we currently expect net cash outlays of approximately $15 million to $25 million for ongoing legal fees related to the Security Incident for full year 2022. For full year 2022, we currently expect net pre-tax expense of approximately $30 million to $35 million for ongoing legal fees related to the Security Incident. Although we carry insurance against certain losses related to the Security Incident, we have exceeded the limit of that insurance coverage. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgments) or all types of claims that may arise in connection with the Security Incident, which could materially and adversely affect our liquidity and results of operations. (See Note 10 to our unaudited, condensed consolidated financial statements included in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under the 2020 Credit Facility, we may be forced to renegotiate or obtain a waiver under the 2020 Credit Facility and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due. In addition, publicity or developments related to the Security Incident could in the future have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties, some or all of which could be material. Legal and Compliance Risks Anti-takeover provisions in our charter documents, our Stockholder Rights Agreement (as described below, the "Rights Agreement") and Delaware law may delay or prevent an acquisition of our Company. Provisions of Delaware law, our certificate of incorporation and bylaws and our Rights Agreement may have the effect of delaying or preventing a change in control of our company or deterring tender offers for our common stock that other stockholders may consider in their best interests. Our certificate of incorporation authorizes “blank check” preferred stock, which could be issued by the board of directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock. Stockholder approval is not necessary to issue preferred stock in this manner. Issuance of these shares of preferred stock could have the effect of making it more difficult and more expensive for a person or group to acquire control of us, and could effectively be used as an anti-takeover device. Currently there are no shares of our preferred stock issued or outstanding. Our bylaws provide for an advance notice procedure for stockholders to nominate director candidates for election or to bring business before an annual meeting of stockholders, including proposed nominations of persons for election to our board of directors, and limit the persons who may call special meetings of stockholders. 50 Third Quarter 2022 Form 10-Q Table of Contents Blackbaud, Inc. On October 7, 2022, we declared a dividend of one preferred share purchase right (a “Right”) for each of our issued and outstanding shares of common stock. Each Right entitles the registered holder, subject to the terms of the Rights Agreement, to purchase from us one one-thousandth of a share of our Series A Junior Participating Preferred Stock, par value $0.001 per share (the “Preferred Stock”) at a price of $313.00, subject to certain adjustments (as adjusted from time to time, the “Exercise Price”). Under the Rights Agreement, the Rights will become exercisable if an entity, person or group acquires beneficial ownership of 20% or more of our outstanding common stock in a transaction not approved by our Board of Directors. In the event that the Rights become exercisable due to the ownership threshold being crossed, each Right will entitle its holder (other than the person, entity or group triggering the Rights Plan, whose rights will become void and will not be exercisable) to purchase additional shares of common stock having a then-current market value of twice the Exercise Price. Subject to the terms of the Rights Agreement, the Rights will expire on October 2, 2023. Additional information regarding the Rights Agreement is contained in a Form 8-K filed with the SEC on October 11, 2022. The anti-takeover provisions of Delaware law and provisions in our organizational documents and the Rights Agreement may prevent our stockholders from receiving the benefit from any premium to the market price of our common stock offered by a bidder in a takeover context. Even in the absence of a takeover attempt, the existence of these provisions may adversely affect the prevailing market price of our common stock if they are viewed as discouraging takeover attempts in the future.