Thread by @EphraimGopin

Time for a thread about the Blackbaud breach mess. The lessons here are for ALL #nonprofits, not just clients of Blackbaud.

But we'll start with this:
If I was a #charity client of Blackbaud, I'd be pissed.

2) Blackbaud had a security breach. Someone hacked into their system and spent time there from February until May. Blackbaud paid the hacker's ransom price and they had reassurances from the hacker that no personal data was lifted from the system. (Sure, if you believe a hacker.)

3) However, Blackbaud 😡 didn't tell its #nonprofit clients about the breach until JULY 😡 and only because it was about to become public. Their emails to NPOs revealing the news were impersonal, full of legalese and with almost no apology.

1832communications.com/blog/customer-…

4) They reassured customers that * no personal data of donors was compromised *.

But as I asked 5 weeks ago: "What else is Blackbaud hiding from us?" It took them 2-3 months to let customers know something initially happened. Where there's smoke....

5) Well, now we know the fire: Blackbaud has now admitted that some confidential information was compromised. Not shocked.

See this story from @npquarterly:

nonprofitquarterly.org/blackbaud-admi…

6) Since they refuse to tell the whole truth, this will keep coming out in drips and drabs. I feel really bad for #nonprofits that sent an email to all donors in July letting them know of the breach but reassuring them that confidential, personal data was safe.

7) Now what? They have to email donors again and tell them, "Ummmm there's a chance a hacker has some of your personal info like social security number, banking info and more."

8) Those donors are gonna be upset. The #charity isn't at fault and yet they'll take the brunt of donors anger. This could cost organizations a ton of money. And yet I assume Blackbaud will continue to maintain innocence and not admit more guilt.

9) For all #nonprofits out there, there are 2 important lessons:
Lesson 1: When something bad happens, fess up to it right away! Nothing good comes from hiding the truth. Everyone makes mistakes. People are forgiving. They're less inclined to forgive an attempted cover-up.

10)
Lesson 2: Data security! Your #charity has access to quite a lot of confidential data. Yes, hacks can happen to anyone. But if the info isn't stored properly to start with, it's a thousand times worse. Secure your data NOW.

11) I've had numerous conversations with donors and staff at orgs affected by this. No one is happy.

If you're a Blackbaud client and not demanding full transparency RIGHT NOW, then be prepared for potentially more damaging news to come out in a month or two.

12) If they're not being totally forthright, maybe they're hiding more. I hope not but based on the timeline of the last 8 months...