What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-07-31 compared with 2024-05-01 · 72 added, 81 removed, 40 unchanged (79% of the section changed)

2 unchanged sentences

The following risk factors should be read in conjunction with the risk factors set forth in that Annual Report.

Financial Risks

We significantly increased our leverage in connection with acquisition of EVERFI and may increase our leverage in the future in connection with additional acquisitions, Security Incident costs or other business purposes, which could adversely impact our business and financial performance.

We incurred a substantial amount of indebtedness in connection with acquisitions, including our acquisition of EVERFI, Inc.

(as described in Note 3 in our most recently filed Annual Report on Form 10-K).

As a result of this indebtedness and other borrowings, including our borrowings in March 2024 to fund the ASR Transaction, our interest payment obligations have increased.

In addition, we have been named as a party in various lawsuits in connection with the Security Incident, claims have been asserted by or on behalf of our customers or their constituents, and we are subject to various governmental inquires, requests or investigations.

Responding to and resolving these current and any future lawsuits, claims and/or investigations could result in material remedial and other expenses.

Although we intend to defend ourselves vigorously against the claims asserted against us, we cannot predict the potential outcomes, cost and expenses associated with current and any future claims, lawsuits, inquiries and investigations, which could require that we incur additional indebtedness to fund.

(See Note 9 to our unaudited, condensed consolidated financial statements in this report for additional information regarding the Security Incident.)

The degree to which we are leveraged could have adverse effects on our business, including the following:

• Requiring us to dedicate a substantial portion of our cash flow from operations to payments on our indebtedness, thereby reducing the availability of our cash flow to fund working capital, capital expenditures, acquisitions, dividends, stock repurchases and other general corporate purposes;

• Increasing the amount of interest we pay, particularly if interest rates increase;

• Limiting our flexibility in planning for, or reacting to, changes in our business and the industries in which we operate;

• Restricting us from making additional strategic acquisitions or exploiting business opportunities;

• Placing us at a competitive disadvantage compared to our competitors that have less debt;

• Reducing our currently available borrowing capacity or limiting our ability to borrow additional funds;

• Decreasing our ability to compete effectively or operate successfully under adverse economic and industry conditions.

If we incur additional debt, these risks may intensify.

Our ability to meet our debt service obligations will depend upon our future performance, which will be subject to the financial, business and other factors affecting our operations, many of which are beyond our control.

In addition, additional leverage could impact our ability to meet certain financial and other covenants contained in our 2024 Credit Facilities.

(See Note 13 to our unaudited, condensed consolidated financial statements included in this report for a more detailed description of our 2024 Credit Facilities.) There can be no assurance that we will be able to remain in compliance with the covenants to which we are now subject or may be subject in the future and, if we fail to do so, that we will be able to obtain waivers from our lenders or amend the covenants.

First Quarter 2024 Form 10-Q

Blackbaud, Inc.

In the event of a default under our 2024 Credit Facilities, we could be required to immediately repay all outstanding borrowings, which we might not be able to do and which would materially negatively affect our business, operations and financial condition.

Operational Risks

4 unchanged sentences

However, our investigation into the Security Incident remains ongoing and may provide additional information.

To date, we have received approximately 260 specific requests from customers for reimbursement of expenses incurred by them related to the Security Incident, approximately 214 (or 82%) of which have been fully resolved and closed and approximately 39 (or 15%) are inactive and are considered by us to have been abandoned by the customers.

To date, we have received approximately 260 specific requests from customers for reimbursement of expenses incurred by them related to the Security Incident, all of which have been fully resolved and closed or are inactive and are considered by us to have been abandoned by the customers.

We have also received approximately 400 reservations of the right to seek expense recovery in the future from customers or their attorneys in the U.S., U.K.

2 unchanged sentences

data subjects, which we are reviewing.

In addition, insurance companies representing various customers’ interests through subrogation claims have contacted us, and certain insurance companies have filed subrogation claims in court, of which 3 cases remain active and unresolved.

In addition, presently, we are a defendant in putative consumer class action cases in U.S.

1 unchanged sentence

The plaintiffs in these cases, who generally purport to represent various classes of individual constituents of our customers, generally claim to have been harmed by alleged actions and/or omissions by us in connection with the Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief.

We have received a Civil Investigative Demand from the office of the California Attorney General relating to the Security Incident.

In addition, we are subject to pending governmental actions or investigations by the U.S.

Federal Trade Commission, the U.S.

On May 14, 2024, the Court issued a memorandum opinion and order (1) denying the multi district litigation plaintiffs' motion for class certification because of the plaintiffs' failure to meet their burden of proof as to ascertainability, (2) granting our motion to exclude the multi district litigation plaintiffs' expert on the issue of ascertainability, and (3) denying the multi district litigation plaintiffs' motion to exclude our expert on the issue of ascertainability.

Further, the Court denied as moot all other pending motions.

On May 28, 2024, the plaintiffs filed a petition for permission to appeal under Rule 23(f) of the Federal Rules of Civil Procedure with the Fourth Circuit Court of Appeals (the “Fourth Circuit”) and we subsequently filed an opposition to such petition.

On July 30, 2024, the Fourth Circuit denied the plaintiffs' petition.

This litigation remains ongoing.

We are subject to pending governmental actions or investigations by the U.S.

Department of Health and Human Services, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner of Canada.

(See Note 9 to our unaudited, condensed consolidated financial statements included in this report for a more detailed description of the Security Incident and related matters.)

Second Quarter 2024 Form 10-Q

Blackbaud, Inc.

On March 9, 2023, the Company reached a settlement with the SEC in connection with the Security Incident that fully resolved the previously disclosed SEC investigation of the Security Incident.

On October 5, 2023, the Company entered into separate, substantially similar Administrative Orders with each of 49 state Attorneys General and the District of Columbia in connection with the Security Incident which fully resolved the previously disclosed multi-state Civil Investigative Demand and the separate Civil Investigative Demand from the Office of the Indiana Attorney General relating to the Security Incident.

As previously disclosed, on February 1, 2024, the FTC announced its approval of an Agreement Containing Consent Order (the “Proposed Order”) evidencing its settlement with the Company in connection with the Security Incident.

Pursuant to its rules, the FTC placed the Proposed Order and related draft complaint on the public record for a period of 30 days for the receipt of public comments after which the FTC will consider any comments received from interested persons prior to determining whether and in what form to finalize the Proposed Order.

The 30-day comment period is expired on March 14, 2024.

As part of the FTC’s proposed order, the Company has not been fined and is not otherwise required to make any payment.

Furthermore, the Company has agreed to the FTC’s proposed order without admitting or denying any of the FTC’s allegations, except as expressly stated otherwise in the Proposed Order.

If finalized, the settlement described in the Proposed Order will fully resolve the FTC investigation.

Although we believe the Proposed Order will be finalized in substantially its current form, there can be no assurances as to whether that will occur or its timing.

Under the terms of the Proposed Order, we have agreed (i) to not misrepresent (a) the extent to which we maintain, use, delete or disclose certain customer information, (b)

First Quarter 2024 Form 10-Q

Blackbaud, Inc.

the extent to which we protect the privacy, security, availability, confidentiality or integrity of such information or (c) the extent of any security incident or unauthorized disclosure, misuse, loss, theft, alteration, destruction or other compromise of such information, and (ii) to delete certain data, adopt and make public certain record retention limits, establish, implement and maintain a specified information security program, obtain regular independent assessments of the mandated information security program, provide to the FTC specified certifications regarding our compliance with the Proposed Order, provide to the FTC reports of any future security incidents and create and maintain specified recordkeeping.

The form of Proposed Order was furnished as Exhibit 99.2 to the Company’s Current Report on Form 8-K filed with the SEC on February 2, 2024.

As noted above, the terms of the FTC Proposed Order, the Attorneys General Administrative Orders and our settlement with the SEC require that we implement and maintain certain processes and programs and comply with certain legal requirements related to cybersecurity and data protection.

On May 20, 2024, the U.S.

Federal Trade Commission (the "FTC") finalized an Order (the “FTC Order”) evidencing its settlement with us in connection with the Security Incident.

As part of the FTC Order, we were not fined and were not otherwise required to make any payment.

Furthermore, we agreed to the FTC Order without admitting or denying any of the FTC’s allegations, except as expressly stated otherwise in the FTC Order.

The settlement described in the FTC Order fully resolved the FTC investigation.

For more information, see the form of proposed order that was furnished as Exhibit 99.2 to our Current Report on Form 8-K filed with the SEC on February 2, 2024 and is identical in substance to the final FTC Order, and in Note 11 to our audited consolidated financial statements contained in our Annual Report on Form 10-K filed with the SEC on February 21, 2024.

As previously disclosed, on June 13, 2024, we agreed to a Final Judgment and Permanent Injunction with the Attorney General of the State of California (the "Final Judgment") relating to the Security Incident.

This settlement fully resolved the last remaining U.S.

state attorney general investigation into the Security Incident.

Under the terms of the settlement, we agreed to comply with applicable laws;

not to make misleading statements related to our data protection, privacy, security, confidentiality, integrity, breach notification requirements, and similar matters;

and to implement and improve certain cybersecurity programs and tools.

The terms of the settlement with California are generally consistent with those to which we agreed in settling with the other 49 state Attorneys General and the District of Columbia on October 5, 2023, as discussed below.

As part of the settlement, we also agreed to pay a total of $6.8 million to the State of California.

This amount was fully accrued as a contingent liability in the Company's financial statements as of March 31, 2024 and June 30, 2024, and subsequently paid in the third quarter of 2024.

By agreeing to the Final Judgment, Blackbaud has denied wrongdoing or liability of any kind.

Nothing contained in the Final Judgment is intended to be, and shall not in any event be construed or deemed to be, an admission or concession or evidence of any liability or wrongdoing whatsoever on the part of Blackbaud or any fact or violation of law, rule, or regulation.

For more information, see the Final Judgment and Permanent Injunction of the State of California, County of San Diego that was furnished as Exhibit 99.1 to our Current Report on Form 8-K filed with the SEC on June 14, 2024.

As noted above, the terms of the Final Judgment, FTC Order, the Attorneys General Administrative Orders and our settlement with the SEC require that we implement and maintain certain processes and programs and comply with certain legal requirements related to cybersecurity and data protection.

Any future regulatory investigation or litigation settlements may also contain such requirements.

8 unchanged sentences

In addition, any legislative or regulatory changes adopted in reaction to the Security Incident or other companies’ data breaches could require us to make modifications to the operation of our business that could have an adverse effect and/or increase or accelerate our compliance costs.

Second Quarter 2024 Form 10-Q

Blackbaud, Inc.

Significant management time and Company resources have been, and are expected to continue to be, devoted to the Security Incident.

For example, for the three months ended March 31, 2024, we incurred net pre-tax expenses of $10.3 million related to the Security Incident, which included $3.3 million for ongoing legal fees and additional accruals for loss contingencies of $7.0 million.

During the three months ended March 31, 2024, we had cash outlays of $2.0 million related to the Security Incident for ongoing legal fees.

For example, for the three and six months ended June 30, 2024, we incurred net pre-tax expenses of $1.8 million and $12.1 million, respectively, related to the Security Incident, which included $1.8 million and $5.1 million, respectively, for ongoing legal fees and additional accruals for loss contingencies of $0.0 million and $7.0 million, respectively.

During the six months ended June 30, 2024, we had cash outlays of $5.8 million related to the Security Incident for ongoing legal fees.

For full year 2023, we currently expect pre-tax expenses of approximately $5.0 million to $10.0 million and cash outlays of approximately $8.0 million to $13.0 million for ongoing legal fees related to the Security Incident.

5 unchanged sentences

In addition, publicity or developments related to the Security Incident could in the future have a range of other adverse effects on our business or prospects, including causing or contributing to loss of customer confidence, reduced customer demand, reduced customer retention, strategic growth opportunities, and associated retention and recruiting difficulties, some or all of which could be material.

First Quarter 2024 Form 10-Q

Defects, delays or interruptions in our cloud solutions, hosting services and payment services, including those caused by our vendors, partners or other third parties (such as the CrowdStrike Event described below), could diminish demand for these services and subject us to substantial liability.

We utilize data center hosting facilities to provide cloud solutions to a significant number of our subscription customers, hosting services to our on-premise license customers and transactional payment services.

Any damage to, or failure of, these systems or services generally could result in, and have resulted in (as described below), interruptions in service to our customers, notwithstanding any business continuity or disaster recovery agreements or arrangements that may be in place.

Our executive offices and some of our data centers are located in areas that are vulnerable to the effects of climate change and could be subject to increased interruptions as a result of the severity and increased frequency of extreme weather events such as hurricanes, wildfires, floods, heat waves, or power shortages.

Furthermore, because our cloud solutions, hosting service offerings and payment services are complex and incorporate a variety of computer hardware and software systems, our services have in the past developed, and may again develop, errors or defects, whether of our own creation or caused by third parties, that have, and could again, result in unanticipated downtime or other problems for our customers and us.

Internet-based services sometimes contain undetected errors when first introduced or when new versions or enhancements are released.

We have from time to time found defects in our web-based services and new errors might again be detected in the future.

In addition, our customers might use our Internet-based offerings in unanticipated ways that cause a disruption in service for other customers attempting to access their data.

For example, on July 19, 2024, CrowdStrike Holdings, Inc.

(“CrowdStrike”), which provides cybersecurity services to millions of Microsoft Windows systems worldwide, including to certain Windows systems operated by Blackbaud, implemented a software update to its Falcon sensor software that was flawed and caused Falcon to crash, thereby causing widespread crashes of Windows systems into which it was integrated, including certain Windows systems used by us and certain of our customers (the “CrowdStrike Event”).

As a result, some of our customers were unable to access certain of our services and solutions, including our payments processing solutions.

We are still evaluating the actual and potential impact of the CrowdStrike Event on Blackbaud, both directly and indirectly due to the impact on our customers.

Because our customers use our services for important aspects of their businesses, any defects, delays or disruptions in service or other performance problems with our services, such as the CrowdStrike Event, could hurt our reputation, damage our customers' businesses and result in liability for the Company.

For example, customers could elect to cancel their service, delay or withhold payment to us, not purchase from us in the future or make claims against us, which could result in an increase in our provision for credit losses, an increase in collection cycles for accounts receivable, loss of revenue or the expense and risk of litigation.

Any of these could materially harm our business, reputation, financial condition and results of operations.

Second Quarter 2024 Form 10-Q

Blackbaud, Inc.

Legal and Compliance Risks

Provisions in our organizational documents, certain officer compensation arrangements and Delaware law may delay or prevent an acquisition or change of control of our Company that could be deemed beneficial to our stockholders.

Certain provisions in our organizational documents, the Rights Agreement, compensation arrangements with our officers and Delaware law (as summarized below) may have the effect of delaying, deferring, discouraging or preventing an acquisition or change in control of the Company or a change in our management.

This includes tender offers for our common stock, proxy contests or other takeover attempts.

These anti-takeover effects may discourage transactions that might result in the payment of a premium over the market price for shares of our common stock.

Even in the absence of a takeover attempt, the existence of these provisions may adversely affect the prevailing market price of our common stock if they are viewed as discouraging takeover attempts in the future.

Certificate of Incorporation and Bylaw provisions.

The Board of Directors is divided into three classes of directors, as nearly equal in number as possible, with each class serving a staggered term of three years.

The classification of directors will have the effect of making it more difficult and time-consuming for stockholders to change the composition of the Board of Directors, could discourage a third-party from making a tender offer or otherwise attempting to obtain control of the Company and may maintain the incumbency of the Board of Directors.

Our Bylaws contain an advance notice procedure for stockholders proposals to be brought before a meeting of stockholders, including any proposed nominations of persons for election to the Board of Directors.

The Bylaws may have the effect of precluding the conduct of business at a meeting if the proper procedures are not followed and may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect its own slate of directors or otherwise attempting to obtain control of the Company.

The Board of Directors has the authority to issue up to an aggregate of 20,000,000 shares of preferred stock in one or more classes or series and to determine, with respect to any such class or series, the designations, powers, preferences and rights of such class or series, and the qualifications, limitations and restrictions thereof, including dividend rights, dividend rates, conversion rights, voting rights, terms of redemption (including sinking fund provisions), redemption prices, liquidation preferences, and the number of shares constituting any class or series or the designation of such class or series, without further vote or action by the stockholders.

This preferred stock, including the Series A Preferred Stock described below, could have terms that may discourage a potential acquirer from making, without first negotiating with the Board of Directors, an acquisition attempt through which such acquirer may be able to change the composition of the Board of Directors, including a tender offer or other takeover attempt.

The Board of Directors possesses the authority to call and hold emergency special meetings of the Board of Directors with less than forty-eight hours’ notice.

This power to hold an emergency special meeting of the Board of Directors on short notice could discourage a potential acquirer from launching a bid to acquire majority ownership of the Company, a proxy solicitation in order to replace the current Board of Directors, or otherwise attempting to obtain control of the Company.

Stockholder Rights Agreement (the "Rights Agreement").

On October 7, 2022, the Company declared a dividend of one preferred share purchase right for each of the Company’s issued and outstanding shares of Common Stock.

The description and terms of these Rights are set forth in the Rights Agreement by and between the Company and American Stock Transfer & Trust Company, LLC.

Each Right entitled the registered holder, subject to the terms of the Rights Agreement, to purchase from us one one-thousandth of a share of the Series A Junior Participating Preferred Stock, par value $0.001 per share (the “Series A Preferred Stock”) at a price of $313.00, subject to certain adjustments (as adjusted from time to time, the “Exercise Price”).

Under the Rights Agreement, the Rights would have become exercisable if an entity, person or group acquires beneficial ownership of 20% or more of the outstanding Common Stock in a transaction not approved by the Board of Directors.

In the event that the Rights became exercisable due to the ownership threshold being crossed, each Right would have entitled its holder (other than the person, entity or group triggering the Rights Plan, whose rights would have become void and not exercisable) to purchase additional shares of Common Stock having a then-current market value of twice the Exercise Price, which would have likely made any takeover or change of control attempt by such entity, person or group prohibitively expensive.

Subject to the terms of the Rights Agreement, the Rights were scheduled to expire on October 2, 2023.

On October 2, 2023, the Company amended the Rights Agreement to extend the final expiration date from October 2, 2023 to October 2, 2024.

On January 26, 2024, the Company amended the Rights Agreement to substitute Broadridge Corporate Issuer Solutions, LLC as the new rights agent under the Rights Agreement.

On March 18, 2024, the Company terminated the Rights Agreement and eliminated the Series A Preferred Stock as a series of stock under its Amended and Restated Certificate of Incorporation.

First Quarter 2024 Form 10-Q

Financial Risks

We significantly increased our leverage in connection with acquisition of EVERFI and stock repurchases, and may increase our leverage in the future in connection with additional acquisitions, Security Incident costs or other business purposes, which could adversely impact our business and financial performance.