BLACKBAUD INC 10-Q

ITEM 1A. RISK FACTORS We are supplementing Item 1A. Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2022, as filed with the Securities and Exchange Commission on February 24, 2023 (the “Annual Report”). The following risk factors should be read in conjunction with the risk factors set forth in that Annual Report. Operational Risks The Security Incident has had, and may continue to have, numerous adverse effects on our business, results of operations, financial condition and cash flows. As previously disclosed, on July 16, 2020, we contacted certain customers to inform them about the Security Incident, including that in May 2020 we discovered and stopped a ransomware attack. Prior to our successfully preventing the cybercriminal from blocking our system access and fully encrypting files, and ultimately expelling them from our system with no significant disruption to our operations, the cybercriminal removed a copy of a subset of data from our self-hosted environment. Based on the nature of the incident, our research and third party (including law enforcement) investigation we believe that no data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly. However, our investigation into the Security Incident remains ongoing and may provide additional information. To date, we have received approximately 260 customer reimbursement requests and approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K. and Canada related to the Security Incident. We have also received notices of proposed claims on behalf of a number of U.K. data subjects, which we are reviewing. In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and certain insurance companies have filed subrogation claims in court. Customer and insurer subrogation claims generally seek reimbursement of their costs and expenses associated with notifying their own customers of the Security Incident and taking steps to assure that personal information has not been compromised as a result of the Security Incident. In addition, presently, we are a defendant in 19 putative consumer class action cases [17 in U.S. federal courts (which have been consolidated under multi district litigation to a single federal court) and 2 in Canadian courts] alleging harm from the Security Incident. The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. To date, we also have received a consolidated, multi-state Civil Investigative Demand issued on behalf of 49 state Attorneys General and the District of Columbia and a separate Civil Investigative Demand from the office of the California Attorney General relating to the Security Incident. In addition, we are subject to pending governmental actions or investigations by the U.S. Federal Trade Commission, the U.S. Department of Health and Human Services, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada. On March 9, 2023, the Company reached a settlement with the SEC in connection with the Security Incident. This settlement fully resolves the previously disclosed SEC investigation of the Security Incident and is further described in the SEC Order. Under the terms of the SEC Order, the Company agreed to cease-and-desist from committing or causing any violations or any future violations of Sections 17(a)(2) and (3) of the Securities Act and Section 13(a) of the Exchange Act, and Rules 12b-20, 13a-13 and 13a-15(a) thereunder. As part of the SEC Order, the Company also agreed to pay, and has paid, a civil penalty in the amount of $3.0 million. Second Quarter 2023 Form 10-Q 49 Table of Contents Blackbaud, Inc. See Note 8 to our unaudited, condensed consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters. We may be named as a party in additional lawsuits, other claims may be asserted by or on behalf of our customers or their constituents, and we may be subject to additional governmental inquires, requests or investigations. Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses that will not be covered by insurance. For example, we have recorded approximately $50.0 million in aggregate liabilities for loss contingencies related to the Security Incident that we believe we can reasonably estimate as of June 30, 2023. It is reasonably possible that our estimated or actual losses may change in the near term for those matters and be materially in excess of the amounts accrued. Certain governmental authorities are seeking to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our data security costs or otherwise require us to alter how we operate our business. Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations. In addition, any legislative or regulatory changes adopted in reaction to the Security Incident or other companies’ data breaches could require us to make modifications to the operation of our business that could have an adverse effect and/or increase or accelerate our compliance costs. Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident. For example, for the three and six months ended June 30, 2023, we incurred net pre-tax expenses of $26.8 million and $44.6 million, respectively, related to the Security Incident, which included $7.0 million and $14.6 million, respectively, for ongoing legal fees and additional accruals for loss contingencies of $19.8 million and $30.0 million, respectively. During the six months ended June 30, 2023, we had net cash outlays of $15.8 million related to the Security Incident, which included ongoing legal fees and the $3.0 million civil penalty paid during the first quarter of 2023 related to the SEC settlement (as discussed in Note 8). For full year 2023, we currently expect net pre-tax expense of approximately $20.0 million to $30.0 million and net cash outlays of approximately $25.0 million to $35.0 million for ongoing legal fees related to the Security Incident. Although we carry insurance against certain losses related to the Security Incident, we exceeded the limit of that insurance coverage in the first quarter of 2022. As a result, we will be responsible for all expenses or other losses (including penalties, fines or other judgments) or all types of claims that may arise in connection with the Security Incident, which could materially and adversely affect our liquidity and results of operations. (See Note 8 to our unaudited, condensed consolidated financial statements included in this report.) If any such fines or penalties were great enough that we could not pay them through funds generated from operating activities and/or cause a default under the 2020 Credit Facility, we may be forced to renegotiate or obtain a waiver under the 2020 Credit Facility and/or seek additional debt or equity financing. Such renegotiation or financing may not be available on acceptable terms, or at all. In these circumstances, if we were unable to obtain sufficient financing, we may not be able to meet our obligations as they come due. In addition, publicity or developments related to the Security Incident could in the future have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties, some or all of which could be material. Legal and Compliance Risks Provisions in our organizational documents, our Stockholder Rights Agreement (as described below, the "Rights Agreement") , certain officer compensation arrangements and Delaware law may delay or prevent an acquisition or change of control of our Company that could be deemed beneficial to our stockholders. Certain provisions in our organizational documents, the Rights Agreement, compensation arrangements with our officers and Delaware law (as summarized below) may have the effect of delaying, deferring, discouraging or preventing an acquisition or change in control of the Company or a change in our management. This includes tender offers for our common stock, proxy contests or other takeover attempts. These anti-takeover effects may discourage transactions that might result in the payment of a premium over the market price for shares of our common stock. Even in the absence of a takeover attempt, the existence of these provisions may adversely affect the prevailing market price of our common stock if they are viewed as discouraging takeover attempts in the future. 50 Second Quarter 2023 Form 10-Q Table of Contents Blackbaud, Inc. Certificate of Incorporation and Bylaw provisions. The Board of Directors is divided into three classes of directors, as nearly equal in number as possible, with each class serving a staggered term of three years. The classification of directors will have the effect of making it more difficult and time-consuming for stockholders to change the composition of the Board of Directors, could discourage a third-party from making a tender offer or otherwise attempting to obtain control of the Company and may maintain the incumbency of the Board of Directors. Our Bylaws contain an advance notice procedure for stockholders proposals to be brought before a meeting of stockholders, including any proposed nominations of persons for election to the Board of Directors. The Bylaws may have the effect of precluding the conduct of business at a meeting if the proper procedures are not followed and may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect its own slate of directors or otherwise attempting to obtain control of the Company. The Board of Directors has the authority to issue up to an aggregate of 20,000,000 shares of preferred stock in one or more classes or series and to determine, with respect to any such class or series, the designations, powers, preferences and rights of such class or series, and the qualifications, limitations and restrictions thereof, including dividend rights, dividend rates, conversion rights, voting rights, terms of redemption (including sinking fund provisions), redemption prices, liquidation preferences, and the number of shares constituting any class or series or the designation of such class or series, without further vote or action by the stockholders. This preferred stock, including the Series A Preferred Stock described below, could have terms that may discourage a potential acquirer from making, without first negotiating with the Board of Directors, an acquisition attempt through which such acquirer may be able to change the composition of the Board of Directors, including a tender offer or other takeover attempt. The Board of Directors possesses the authority to call and hold emergency special meetings of the Board of Directors with less than forty-eight hours’ notice. This power to hold an emergency special meeting of the Board of Directors on short notice could discourage a potential acquirer from launching a bid to acquire majority ownership of the Company, a proxy solicitation in order to replace the current Board of Directors, or otherwise attempting to obtain control of the Company. Stockholder Rights Agreement. On October 7, 2022, the Company declared a dividend of one preferred share purchase right for each of the Company’s issued and outstanding shares of Common Stock. The description and terms of these Rights are set forth in the Rights Agreement by and between the Company and American Stock Transfer & Trust Company, LLC. Each Right entitles the registered holder, subject to the terms of the Rights Agreement, to purchase from us one one-thousandth of a share of the Series A Junior Participating Preferred Stock, par value $0.001 per share (the “Series A Preferred Stock”) at a price of $313.00, subject to certain adjustments (as adjusted from time to time, the “Exercise Price”). Under the Rights Agreement, the Rights will become exercisable if an entity, person or group acquires beneficial ownership of 20% or more of the outstanding Common Stock in a transaction not approved by the Board of Directors. In the event that the Rights become exercisable due to the ownership threshold being crossed, each Right will entitle its holder (other than the person, entity or group triggering the Rights Plan, whose rights will become void and will not be exercisable) to purchase additional shares of Common Stock having a then-current market value of twice the Exercise Price, which would likely make any takeover or change of control attempt by such entity, person or group prohibitively expensive. Subject to the terms of the Rights Agreement, the Rights will expire on October 2, 2023. Additional information regarding the Rights Agreement is contained in a Form 8-K filed with the SEC on October 11, 2022. Officer Compensation Arrangements. We have entered into an employment agreement with our Chief Executive Officer and retention agreements with certain of our officers, which provide that, upon the occurrence of a change in control of us and either the termination of their employment without cause (as defined) or their resignation for good reason (as defined), such persons would be entitled to certain termination or severance payments made by us (which may include a lump sum payment equal to defined percentages of compensation and accelerated vesting of certain equity stock awards paid in accordance with the terms and conditions of the respective agreement). Such provisions could significantly increase the costs to a third-party acquirer and/or deter such third-party from acquiring us. Delaware anti-takeover law . We are subject to Section 203 of the Delaware General Corporation Law, an anti-takeover law. In general, Section 203 prohibits a publicly held Delaware corporation, such as the Company, from engaging in a “business combination” with an “interested stockholder” for a period of three years following the date the person became an interested stockholder, unless certain criteria are met. Generally, a “business combination” includes a merger, asset or stock sale, or other transaction resulting in a financial benefit to the interested stockholder. Generally, an “interested stockholder” is a person who, together with affiliates and associates, owns, or is an affiliate or associate of the corporation, and within three years prior to the determination of interested stockholder status did own, 15% or more of a corporation’s voting stock. Second Quarter 2023 Form 10-Q 51 Table of Contents Blackbaud, Inc.