DEV Community: DefendMyRep

Find Your Details on Data-Broker Sites and Get Them Removed: A Free-First Workflow

DefendMyRep — Sat, 14 Nov 2026 07:17:17 +0000

A breach exposes your details once. Data brokers are the market that keeps them circulating. If your name, address and phone number turn up in a breach notice, the practical question is how to find where they now appear and how to get them taken down without paying anyone. This is a free-first workflow, in the order we would run it. It is general information, not legal advice.

What counts as a data broker

California defines the category narrowly: a business that knowingly collects and sells "to third parties the personal information of a consumer with whom the business does not have a direct relationship." You never signed up with them, which is why you have to go and look.

Step 1: lock the money side first

Deleting a listing does nothing about a thief who already has your details, so freeze your credit before you start. The FTC says "There's no cost to place or lift a credit freeze, and it doesn't affect your credit score," and "Anyone can do it, any time." You contact all three bureaus: Equifax, Experian and TransUnion. A freeze lasts until you lift it, and while it is on "nobody can open a new credit account in your name, including you."

Step 2: find the listings

Finding the URLs is the real work, because every removal request needs one. Open a private browser window and search your full name in quotes with your city, then your home address, then your phone number and email address. Log every URL in a spreadsheet with the date and a screenshot. Repeat monthly.

Step 3: California residents, file a DROP request

California built one free form for this: the Delete Request and Opt-out Platform (DROP), run by the California Privacy Protection Agency. The agency's published timeline:

January 1, 2026: DROP launches and residents can submit requests.
August 1, 2026: data brokers begin processing requests.
Brokers must delete data every 45 days.

It costs nothing, needs only your name, date of birth and ZIP code, and the agency says "The more information you enter, the more likely your data will be deleted." You get one of two outcomes. "Deleted" means the broker matched you and deleted non-exempt data. "Opted-out" means it could not make an exact match, so it "can no longer sell or share" your data but still holds it. A broker that fails to delete faces $200 per request per day, enforced by the agency.

Know what DROP does not touch, in the agency's words: "Data given directly to a business (first-party data)," exempted data, and publicly available data. It also says "Results vary by broker." It does not reach a forum post or paste site where breached records were dumped, or news coverage.

Step 4: outside California

DROP requires California residency. If you live elsewhere, removal runs broker by broker, with no single form. Use your URL log from step 2 and each broker's own opt-out page, and check your own state's broker rules, which this article does not cover.

Step 5: Google results

Google's "Results about you" tool monitors and requests removal of results showing your contact details. On February 10, 2026, Google said it can also find and request removal of results containing government-issued IDs such as a passport, driver's license or social security number, rolling out in the U.S. With notifications on you get one "within a few hours" when results match.

Its limits are worth knowing before you spend a week on it:

It removes results, not the page. Google: "Even if Google removes something from Google Search, it might still be on the internet."
A removed page "won't show up on Google search results for any search query that contains your name or identifier. But, it might show up if they search for something else."
It will not remove pages owned by educational or government institutions or newspapers, and newsworthy content may stay.

Step 6: watch for impersonation

The FTC's consumer alert dated November 12, 2026 reports more than 1 million imposter scam reports last year, with reported losses of $3.5 billion. Agree one rule with your family and assistant: no payment or credential change on the strength of a message alone. A call to a number you already have confirms it.

Where this runs out

The free steps cover credit, California brokers and Google. Continuous monitoring, brokers outside California's mechanism with documented re-checks, and takedown escalation when Google is not enough are the continuous, adversarial part. We are DefendMyRep, a reputation and privacy defense firm, and our longer guide has every source: Your Driver's License and Home Address Were in a Data Breach. On where leaked records tend to surface first, see our note on dark forum monitoring. To see what is currently findable about you or your business, request a free reputation audit report.

A Breach Notice Checklist for Small Business Owners: Clocks, Wording and the Public Page

DefendMyRep — Sat, 14 Nov 2026 07:17:00 +0000

Your customers' data is exposed, and "72 hours" is the only deadline you have heard of. It is one of several, and it is owed to a regulator, not to your customers. This is a checklist for the small business owner who has to act this week: what to record, which deadlines can apply, what the notice must say, and what to publish on your own site. It is general information, not legal advice. Your lawyer decides which rules apply to you.

1. Write down when you found out

Open one incident log today. Record who told you, by what channel, and when. That timestamp matters because each rule starts its clock from a different trigger.

Under GDPR Article 33(1) you notify the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware." Late is allowed if you give reasons. Partial is allowed, in phases. And a breach you decide not to report still has to be documented.

2. Map the clocks that apply to you

GDPR (people in the EU): 72 hours after awareness, where feasible, to the regulator. Individuals are told "without undue delay" when the risk to them is high.
California (residents' data): since January 1, 2026, disclosure within 30 calendar days of discovery or notification. If more than 500 residents are notified, a sample copy goes to the Attorney General within 15 calendar days of notifying them.
HIPAA: individual notices without unreasonable delay and no later than 60 days after discovery.
FTC Safeguards Rule (non-bank financial institutions): notify the FTC within 30 days of discovery of a breach affecting at least 500 consumers.
SEC Form 8-K Item 1.05 (public companies): four business days after the company determines the incident is material.
Everywhere else: every state, the District of Columbia, Puerto Rico and the Virgin Islands has its own law. Ask counsel to map the states where your customers live.

If the breach happened at a vendor, the duty to tell people usually stays with you. California requires the vendor to notify the data owner "immediately following discovery," and your own 30 days then run from that notification.

3. Use the required headings, wherever you are

California requires a notice titled "Notice of Data Breach" with five headings: What Happened? What Information Was Involved? What We Are Doing. What You Can Do. For More Information. They make a good skeleton for any notice. If a Social Security or driver's license number was exposed and you were the source, California also requires at least 12 months of identity theft prevention and mitigation services at no cost.

Send the notice to people directly. The European Data Protection Board says a notification "solely confined within a press release or corporate blog would not be an effective means of communicating a breach to an individual."

4. Say only what you can prove

On July 16, 2020, the software vendor Blackbaud announced that the attacker "did not access donor bank account information or social security numbers." The SEC says that within days, company personnel learned the attacker had accessed and taken that information. In 2023 Blackbaud agreed to a $3 million SEC civil penalty over misleading disclosures, and later a $49.5 million settlement with 49 state attorneys general and the District of Columbia. The lesson for a small business is cheap to follow: nothing in your press statement should be broader or more reassuring than what you told regulators.

5. Publish one owned page

Put plain-language answers on your own site: what happened, what was involved, what you are doing, and how you will contact people in future. Say which channels you will never use, for example payment requests by text. Breach-themed phishing follows every public incident, and this line helps your customers spot it.

6. Plan for the review wave

Expect one-star reviews from affected customers and from people who only read the headline. Do not report a review just because you dislike it: Google says it only removes reviews that violate its policies. Reply to each real review with the same facts as your notice. Never buy, script or suppress reviews. The FTC's rule on fake reviews, 16 CFR Part 465, has applied since October 21, 2024, with a civil penalty ceiling of $53,088 per violation. We wrote up what Google, Yelp and Trustpilot will and will not remove in After the Breach Notice, the Reviews.

One-page version

Incident log opened, awareness time recorded.
Counsel confirms which clocks apply.
Notice drafted with the five headings, sent directly.
Public statement matches the notice, word for word in substance.
Owned page live.
Review replies drafted from the same facts.

We are DefendMyRep, a reputation and privacy defense firm. Every rule above is sourced in our longer, hour-by-hour guide, The First 72 Hours After a Data Breach Goes Public. To see what a stranger finds when they search your business name, you can request a free reputation audit report.

The First 72 Hours After a Data Breach Goes Public: Legal Clocks, Press, Search Results and Reviews

DefendMyRep — Sat, 14 Nov 2026 07:08:08 +0000

"You have 72 hours" is the most repeated line in breach advice, and it is a half-truth. The number comes from one law, Article 33 of the GDPR. It applies "where feasible." It runs from when you become aware of the breach. And it is owed to a regulator, not to your customers.

The clock that actually governs your reputation is a different one. It starts when the story is public: a reporter has the file, a researcher posts a screenshot, an attacker lists your data for sale, or a customer opens a letter. Your investigation can still be running when that happens. This post separates the two kinds of clock, sets out what the main rules say in their own words, and then lays out an hour-by-hour plan for the public side: notices, press, search results and reviews.

Every rule and figure below was read from the primary source on November 14, 2026. Which rules apply to you depends on where your customers live, what data you hold and whether you are a public company, so treat this as a map for the conversation with counsel, not a substitute for it.

Two kinds of clock

Legal clocks start on a trigger defined by each rule: becoming "aware" (GDPR), discovery (HIPAA, California), or your own materiality determination (SEC). They can run in parallel, and their start dates differ.

The reputation clock starts at first public exposure and has no rulebook. Customers, journalists and search engines act on what they can find, not on what your legal team has determined. The practical goal of the first 72 hours is to make sure the first accurate account of the incident that people can find is yours.

The legal clocks, in the rules' own words

GDPR (personal data of people in the EU)

Article 33(1): "the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority," unless the breach "is unlikely to result in a risk to the rights and freedoms of natural persons."

What the text adds that the shorthand drops:

Late is allowed, with reasons: "Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay."
Partial is allowed: "Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay."
Even a breach you do not report must be recorded: "The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken."

"Aware" has a meaning. The European Data Protection Board says a controller is aware "when that controller has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised." It also says the investigation period does not give you unlimited time: "it is expected that the initial investigation should begin as soon as possible," and "If a controller fails to act in a timely manner and it becomes apparent that a breach did occur, this could be considered as a failure to notify in accordance with Article 33 GDPR." And over-reporting is safe: "There is no penalty for reporting an incident that ultimately transpires not to be a breach."

Individuals are a separate duty with no hour count. Article 34(1): when a breach "is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay." The EDPB notes that "The threshold for communicating a breach to individuals is therefore higher than for notifying supervisory authorities."

Currency check: the European Commission's Digital Omnibus proposal would amend the GDPR. The European Parliament's procedure page, fetched November 14, 2026, shows it at "Awaiting committee decision," so the Article 33 text above is the current law.

Sources: GDPR Article 33, Article 34, EDPB Guidelines 9/2022, European Parliament Legislative Observatory, 2025/0360(COD).

SEC Form 8-K Item 1.05 (U.S. public companies)

The SEC's July 26, 2023 release says: "An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material." The SEC's small-entity guide is explicit that the trigger is not discovery: "the deadline for filing an Item 1.05 Form 8-K is tied not to discovery but to the registrant's determination that the incident is material," and registrants must make that determination "without unreasonable delay." Disclosure may be delayed if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing.

On May 21, 2024, the Division of Corporation Finance said that when materiality is not yet determined, or the incident is not material, it encourages disclosure under a different item such as Item 8.01. If the impact is not yet known but the incident is material, file Item 1.05, "include a statement noting that the company has not yet determined the impact (or reasonably likely impact) of the incident, and amend the Form 8-K to disclose the impact once that information is available." The statement carries a caveat: "This statement, like all staff statements, has no legal force or effect."

Currency check: we read the SEC's own pages, the latest of which was last reviewed in September 2024. A May 21, 2026 law-firm tracker reported that the SEC had asked for comment on Regulation S-K in January 2026 and that it was unknown whether the 2023 cyber rules would be revisited. We read no primary document showing a change, but confirm current status before you rely on it.

Sources: SEC press release 2023-139, SEC small entity compliance guide, SEC staff statement, May 21, 2024, Debevoise Data Blog, May 21, 2026.

HIPAA (covered entities and their business associates)

HHS says individual notices "must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach." The 60 days is the outer limit, and "without unreasonable delay" comes first. If a breach affects 500 or more individuals, the Secretary must be notified on the same standard. Covered entities with a breach affecting "more than 500 residents of a State or jurisdiction" must also "provide notice to prominent media outlets serving the State or jurisdiction." A business associate must tell the covered entity "without unreasonable delay and no later than 60 days from the discovery of the breach." The HHS page we read was last reviewed July 26, 2013, so confirm against 45 CFR 164.400-414.

Source: HHS, Breach Notification Rule.

California (businesses with California residents' data)

Since January 1, 2026, Civil Code 1798.82(a)(2)(A) says disclosure "shall be made within 30 calendar days of discovery or notification of the data breach." Delay is permitted "to accommodate the legitimate needs of law enforcement" or "as necessary to determine the scope of the breach and restore the reasonable integrity of the data system." If more than 500 California residents are notified, you must "electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General within 15 calendar days of notifying affected consumers." The notice "shall be titled 'Notice of Data Breach'" with headings "What Happened?", "What Information Was Involved?", "What We Are Doing," "What You Can Do," and "For More Information." If you were the source of a breach that exposed a Social Security or driver's license number, you must offer identity theft prevention and mitigation services at no cost for not less than 12 months.

Two consequences for reputation. The Attorney General's page says residents "may Search Data Security Breaches that have been submitted to and published by our office," so a notice to more than 500 Californians becomes a public record. And older articles saying California has no fixed day count are out of date.

Sources: California Civil Code 1798.82, California Attorney General, Data Security Breach Reporting.

Non-bank financial institutions: the FTC Safeguards Rule

Since May 13, 2024, covered financial institutions must notify the FTC "no later than 30 days after discovery" of a breach involving the information of at least 500 consumers. Source: FTC Business Blog, May 14, 2024.

Everywhere else

The FTC's business guide notes that every state, the District of Columbia, Puerto Rico and the Virgin Islands have breach notification laws. We could not read a complete multi-state survey for this post, so we cite no other state's deadline. Counsel needs to map each state where affected people live. Source: FTC, Data Breach Response: A Guide for Business.

The public side, hour by hour

What follows is our recommended sequence, not a legal requirement. The hours are approximate. The point is the order.

Hours 0 to 12: confirm, preserve, convene

Assemble the team. The FTC's guide says to bring together forensics, legal and communications, and not to destroy evidence.
Write down when you became aware, and who knew what. This is the date the GDPR clock and the EDPB's "reasonable degree of certainty" test will be argued from. Start one incident log and keep every decision in it.
Stop the bleeding. The FTC advises removing improperly posted information and asking search engines and other sites to drop copies. Do this early, because it is easier before the story is indexed.

Hours 12 to 36: facts first, and no reassurance you cannot back

The most expensive mistake in this window is a premature "no sensitive data was affected." In the SEC's 2023 case against Blackbaud, the company announced on July 16, 2020 that the attacker "did not access donor bank account information or social security numbers." The SEC says that within days of those statements, Blackbaud's technology and customer relations personnel learned the attacker had in fact accessed and exfiltrated that information, but the employees "did not communicate this information to senior management responsible for its public disclosure." Blackbaud agreed to a $3 million civil penalty, and the SEC's charges were about misleading disclosures, not about the attack itself. A reassurance that later breaks becomes the headline.

So in this window:

Decide, with counsel, which clocks apply and which notices are triggered now. Phased filing is permitted under GDPR, and the SEC staff's guidance allows an Item 1.05 filing that says impact is not yet determined.
Draft the individual notice using the required headings and content: California's five headings above, GDPR 33(3)'s nature of the breach, categories and approximate numbers, contact point, likely consequences and measures taken.
Hold your public statement to what the notice says. Nothing in the press release should be broader or more reassuring than what you are telling regulators.

Hours 36 to 72: notices, owned page, press, search, reviews

Notify people directly. A press release does not count. The EDPB: "A notification solely confined within a press release or corporate blog would not be an effective means of communicating a breach to an individual," and "Dedicated messages should be used when communicating a breach to data subjects and they should not be sent with other information, such as regular updates, newsletters, or standard messages." HHS specifies first-class mail, or email if the person agreed to electronic notice.

Publish an owned page. The FTC's guide tells breached businesses to anticipate questions and put plain-language answers on their website, and to tell people how you will contact them in future. The second point doubles as phishing defense: once a breach is public, scammers imitate it, so tell people which channels you will never use. California's notice headings are a ready skeleton for the page.

Brief the press from the same text. If HIPAA's media rule applies, you have to do it anyway. Where you notify more than 500 California residents, a journalist can find your notice on the Attorney General's public list, so assume the notice itself is the first draft of the story.

Plan for search. News coverage of the breach will rank, and you usually cannot remove it. Google's help page says it will not remove "web pages that are owned by: Educational or government institutions; Newspapers," and that "if the content is about something important or newsworthy, like the news, Google might not take it down." Your lever is a clear, dated, accurate page of your own that answers what people search for. Individuals whose data leaked have their own tools; our guide to what to do when your license, email and address leak is worth linking from your notice page.

Plan for reviews. Expect a wave, from affected customers and from people reacting to the news. Yelp describes its response to such surges: "When we notice an unusual spike in activity on a business page, we will display an Unusual Activity Alert and temporarily disable the posting of content." Google is blunt about flagging: "Do not report a review just because you disagree with it or dislike it." Reply to each real review with the same facts as your notice. Never buy, script or suppress reviews: the FTC's Consumer Reviews and Testimonials Rule has been in effect since October 21, 2024, and its civil penalty ceiling is $53,088 per violation. The full playbook, including measurement, is in After the Breach Notice, the Reviews.

Sources: EDPB Guidelines 9/2022, SEC press release 2023-48, Blackbaud, Google Search Help, Results about you, Google Search Help, Remove my private info, Yelp Trust and Safety, Google Business Profile Help, 16 CFR 1.98.

Mistakes that make hour 72 worse

Treating a press release as notice. See the EDPB sentence above.
Reassuring before you know. The Blackbaud statement is the cautionary example.
Reading the clocks from the wrong date. GDPR counts from awareness, the SEC from materiality determination, HIPAA and California from discovery. Do not use that as a reason to delay the investigation, as the EDPB's warning on timely action makes clear.
Going silent after the notice. People who receive a letter go looking for the company's side. If your owned page is empty, someone else's account fills the gap.
Acting on reviews in a way that creates a second incident. Fake, incentivized or suppressed reviews turn a security story into a trust story.
Blaming a vendor in public. If a supplier's breach is the cause, your own responsibility to notify usually remains. That is a topic of its own: Your Vendor Was Breached and Your Customers Blame You.

Where a reputation team fits

The legal work belongs to counsel. The reputation work, meaning the owned page, press handling, search monitoring and review replies, can run in parallel from hour zero, and is faster when the groundwork exists before the incident. That is the shape of our Crisis PR, Reputation Monitoring and Review Management engagements. For a broader executive-level view, see the executive reputation crisis playbook.

To see how exposed your reputation is before an incident, the 90-second audit runs in your browser. The strategy call is free. This article is general information, not legal advice.

Originally published at defendmyrep.com.

Your Vendor Was Breached and Your Customers Blame You: Who Notifies Whom, and What Blackbaud Teaches

DefendMyRep — Sat, 14 Nov 2026 06:33:48 +0000

When a software vendor is breached, the people whose data was in it have usually never heard of the vendor. They know the school, the clinic, the charity, the bank or the store that collected their details. The letter, the phone call and the one-star review all go to that name.

This post covers the legal map of who has to tell whom when a supplier is breached, what the Blackbaud cases show about how vendor behavior shapes the customer's position, and what a customer should do in the first 72 hours after a supplier's notice. The legal and enforcement facts below were read from the primary source on November 14, 2026. One thing we did not find in any source: a measurement of how consumers assign blame in a vendor breach. The reputational reasoning in this post is our analysis of the legal structure, and we flag it as such.

The pattern is common, not rare

Verizon's 2026 Data Breach Investigations Report executive summary says: "As organizations increase their reliance on third parties for services and software, their exposure increases, as well, and breaches with third-party involvement have increased by 60% from last year's dataset, reaching 48% of total breaches." IBM's 2026 Cost of a Data Breach Report found that supply chain data breaches, "in which business partners were compromised and became an attack vector, were the most expensive factor in increasing breach costs, adding USD 227,250 on average," and that this kind of breach "is difficult to detect and contain, since it involves another organization's IT infrastructure and security practices." IBM also reports that supply chain compromises lasted 258 days.

Sources: Verizon, 2026 DBIR Executive Summary, IBM, Cost of a Data Breach Report 2026.

Who notifies whom: three regimes

The vocabulary differs, but the structure is the same in each: the vendor tells the customer, and the customer tells the people.

GDPR: processor to controller, and the responsibility stays with the controller

Article 33(2): "The processor shall notify the controller without undue delay after becoming aware of a personal data breach." There is no hour count for the vendor. The EDPB says the GDPR "does not provide an explicit time limit within which the processor must alert the controller, except that it must do so 'without undue delay'", and that it "recommends the processor promptly notifies the controller."

Then the controller's clock. The EDPB: "The controller uses the processor to achieve its purposes; therefore, in principle, the controller should be considered as 'aware' once the processor has informed it of the breach." So the 72-hour clock in Article 33(1), which is owed to the supervisory authority and applies "where feasible," starts when the vendor tells you. A slow vendor therefore delays your clock, but not your customers' exposure, and the delay is the vendor's to answer for: the FTC's account of Blackbaud includes a wait of nearly two months before it notified its customers.

Can the vendor notify for you? Only if you authorize it, and it does not move the duty: "A processor could make a notification on behalf of the controller, if the controller has given the processor the proper authorisation ... However, it is important to note that the legal responsibility to notify remains with the controller." When one vendor breach affects many customers, the EDPB says "the processor will have to report details of the incident to each controller."

Article 28(3)(f) is where you make this enforceable: the processor contract must stipulate that the processor "assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36," which includes Articles 33 and 34.

HIPAA: business associate to covered entity

HHS: "A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach." And on who answers to patients: "while the covered entity is ultimately responsible for ensuring individuals are notified, the covered entity may delegate the responsibility of providing individual notices to the business associate." A 60-day outer limit for the vendor is long. Your contract should say something shorter. The HHS page we read was last reviewed July 26, 2013, so check the regulation text at 45 CFR 164.400-414.

California: vendor to owner "immediately"

Civil Code 1798.82(b): a business "that maintains computerized data that includes personal information that the individual or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery." The owner's own duty is then in subdivision (a): disclosure "within 30 calendar days of discovery or notification of the data breach," effective January 1, 2026. The statute names notification as a trigger, so a vendor's notice starts your clock.

Sources: GDPR Article 33, Article 28, EDPB Guidelines 9/2022, HHS, Breach Notification Rule, California Civil Code 1798.82.

For the wider set of clocks, including the SEC's four business days after a materiality determination and the FTC Safeguards Rule's 30 days, see the first 72 hours after a breach goes public. Whether a vendor's incident counts as your own cybersecurity incident for Form 8-K purposes is a question we did not verify; put it to securities counsel.

What Blackbaud shows

Blackbaud sells donor data management software; the New York Attorney General lists its affected customers as including charities, colleges and universities, and health care organizations. The primary record, in order:

Early 2020: the FTC says "a hacker in early 2020 exploited weaknesses in Blackbaud's networks, which went undetected for three months, allowing the hacker to remove massive amounts of unencrypted sensitive consumer data belonging to Blackbaud's customers."
July 16, 2020: Blackbaud announced that the ransomware attacker did not access donor bank account information or social security numbers. The SEC says that within days, the company's technology and customer relations personnel learned the attacker had in fact accessed and exfiltrated it. The SEC also says the company "omitted this material information about the scope of the attack" from an August 2020 quarterly report.
The scale: the SEC says the attack "impacted more than 13,000 customers." The New York Attorney General describes "over 13,000 institutions that were Blackbaud customers and millions of their respective consumer constituents," and says Blackbaud "paid the threat actor a ransom and was provided evidence that the stolen data was deleted."
The customer notice: the FTC says Blackbaud "waited nearly two months to notify its customers about the breach and then misled consumers about the extent of the data that was stolen, according to the complaint."
March 9, 2023: the SEC announced a $3 million civil penalty for misleading disclosures about the attack. Blackbaud agreed to the order "without admitting or denying the SEC's findings."
October 5, 2023: a multistate coalition announced a $49.5 million settlement. Blackbaud's own release says it was "with 49 state Attorneys General and the District of Columbia," and that it agreed "not to make misleading statements related to its data protection, privacy, security, confidentiality, integrity, breach notification requirements and similar matters."
May 20, 2024: the FTC finalized its order. Blackbaud "is required to delete data that it no longer needs to provide its products or services and is prohibited from misrepresenting its data security and data retention policies." It "also requires Blackbaud to notify the FTC if it experiences a future data breach that it is required to report to any other local, state, or federal agency."

The line that matters most for customers is in the New York Attorney General's release. Following the breach, Blackbaud "neglected to provide its customers with timely, complete, or accurate information regarding the breach, as required by law," and as a result "notification to the consumers whose personal information was exposed was significantly delayed or never occurred at all, as Blackbaud downplayed the incident and led its customers to believe that no notification was required."

Read that as a customer. The obligation to tell donors, patients and students sat with the institutions. The vendor's incomplete account shaped whether and when they did it. The settlement terms respond to exactly that: they include "Updating breach notification provisions that require Blackbaud to provide appropriate assistance to its customers and support customers' compliance with applicable notification requirements in the event of a breach," plus "total database encryption and dark web monitoring" and "third-party assessments of Blackbaud's compliance with the settlement for seven years."

Sources: FTC press release, May 20, 2024, FTC case page, SEC press release 2023-48, New York Attorney General, Blackbaud, October 5, 2023. We read the agencies' press releases, not the underlying complaint or the SEC order itself.

How the blame lands on the customer-facing brand

This section is our analysis, built from the legal structure above. No source we read measured how consumers or donors attributed blame in the Blackbaud matter.

The notice comes from you. Under each regime above, the owner, controller or covered entity is the party that tells individuals. So the person's first contact with the incident is a letter with your name on it, or, if the notice is late or never comes, a news story or the California Attorney General's public breach list. In both cases your name is the one attached.
The vendor stays offstage. Individuals rarely know the supplier. Whatever you say about it is the only explanation they receive.
The responsibility is not transferable. The EDPB says "the legal responsibility to notify remains with the controller," and HHS says the covered entity is "ultimately responsible." Public statements that read as passing the blame sit badly with that.
A vendor's downplaying becomes your timeline problem. The New York Attorney General's finding is the example: customers were led to believe notification was not required, and consumer notices were delayed or never occurred.
The review wave lands on your profiles, not the vendor's. Google, Yelp and Trustpilot pages belong to the customer-facing business. Our companion guide on reviews after a breach notice covers what the platforms will and will not remove.

Your first 72 hours after a supplier's notice

This is our recommended sequence. The legal deadlines belong to counsel.

Hours 0 to 12.

Record the exact time and channel by which the vendor told you. It is the likely start of your GDPR awareness and of California's "notification" trigger. Open one incident log.
Ask for facts in writing: which of your data sets were involved, categories and approximate numbers of people, dates, whether the data was encrypted, whether it was acquired or only accessible, and what the vendor has done. These map onto the content GDPR 33(3) requires you to give a regulator.
Do not repeat the vendor's reassurances as your own until you have verified them. Blackbaud's July 2020 statement is the cautionary tale.

Hours 12 to 36.

Decide with counsel which clocks apply to you and when each started.
Decide whether the vendor may send notices on your behalf. Under GDPR it needs your authorization and the duty stays yours; under HIPAA you may delegate to the business associate but remain ultimately responsible. If you delegate, approve the text.
Draft your own individual notice. California's required headings (What Happened? What Information Was Involved? What We Are Doing, What You Can Do, For More Information) give you a clear structure.

Hours 36 to 72.

Send direct notices. The EDPB says a press release or corporate blog alone "would not be an effective means of communicating a breach to an individual."
Publish an owned page with plain-language answers and the channels through which you will, and will never, contact people.
Say plainly that a service provider you use was breached, and say what you are doing for the people affected. Whether to name the vendor is a legal and contractual decision, and nothing we read requires it. Avoid language that reads as blaming the vendor for your obligations.
Brief the people who will answer the phones and the review replies with the same text.

Fix the contract before the incident

The settlement terms and the statutes point to a short checklist for any vendor holding personal data:

A notification deadline shorter than the legal outer limits, in hours or one to two business days from the vendor's discovery, plus an obligation to give scope facts and update them. The law's outer limits for vendors are "without undue delay," "immediately following discovery" in California and 60 days in HIPAA.
Assistance obligations. GDPR Article 28(3)(f) requires it. The Blackbaud settlement shows regulators treat the lack of it as a failure.
Audit rights. Article 28(3)(h): the processor "makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections."
Sub-processor control. Article 28(2): "The processor shall not engage another processor without prior specific or general written authorisation of the controller." And Article 28(4): the initial processor "shall remain fully liable to the controller for the performance of that other processor's obligations."
Deletion and minimization. The FTC's order against Blackbaud requires it to delete data it no longer needs. Ask your vendors what they retain after the service ends, and ask for return or deletion at termination (Article 28(3)(g)).
Encryption. The FTC alleges the data taken was unencrypted. Article 34(3)(a) shows why encryption matters on your side as well: you may not have to notify individuals if the data was protected by measures "such as encryption."

Where a reputation team fits

The legal work and the vendor negotiation belong to counsel. The public layer, meaning the owned page, press handling, search monitoring and review replies, runs in parallel from the hour the vendor's notice arrives. That is the work of our Crisis PR, Reputation Monitoring and Business Reputation Management engagements.

If the people exposed include your executives, the other half of this story is in what to do when your own license, email and address leak.

The 90-second audit shows how exposed your reputation is before an incident. The strategy call is free. This article is general information, not legal advice.

Originally published at defendmyrep.com.