In particular, the company stated (i) as to the specific incident, that the attacker simply "removed a copy of a subset of data" and (ii) as to cybersecurity risks generally, a compromise of donor information " could adversely affect" the company's operations. According to the SEC, such statements were misleading "because they perpetuated the false impression. .. that the incident did not result in the attacker accessing highly sensitive donor data." The SEC charged Blackbaud with violations of Sections 17(a)(2) and (3) of the Securities Act. As announced last week, the company agreed to settle the charges for $3,000,000. While this incident has likely been put to rest, the SEC has shown no signs of slowing down its enforcement actions against companies related to cybersecurity and data privacy. Privacy World will be here to monitor for the next action. Stay tuned.