Your Vendor Was Breached and Your Customers Blame You: Who Notifies Whom, and What Blackbaud Teaches

When a software vendor is breached, the people whose data was in it have usually never heard of the vendor. They know the school, the clinic, the charity, the bank or the store that collected their details. The letter, the phone call and the one-star review all go to that name.

This post covers the legal map of who has to tell whom when a supplier is breached, what the Blackbaud cases show about how vendor behavior shapes the customer’s position, and what a customer should do in the first 72 hours after a supplier’s notice. The legal and enforcement facts below were read from the primary source on November 14, 2026. One thing we did not find in any source: a measurement of how consumers assign blame in a vendor breach. The reputational reasoning in this post is our analysis of the legal structure, and we flag it as such.

The pattern is common, not rare

Verizon’s 2026 Data Breach Investigations Report executive summary says: “As organizations increase their reliance on third parties for services and software, their exposure increases, as well, and breaches with third-party involvement have increased by 60% from last year’s dataset, reaching 48% of total breaches.” IBM’s 2026 Cost of a Data Breach Report found that supply chain data breaches, “in which business partners were compromised and became an attack vector, were the most expensive factor in increasing breach costs, adding USD 227,250 on average,” and that this kind of breach “is difficult to detect and contain, since it involves another organization’s IT infrastructure and security practices.” IBM also reports that supply chain compromises lasted 258 days.

Sources: Verizon, 2026 DBIR Executive Summary, IBM, Cost of a Data Breach Report 2026.

Who notifies whom: three regimes

The vocabulary differs, but the structure is the same in each: the vendor tells the customer, and the customer tells the people.

GDPR: processor to controller, and the responsibility stays with the controller

Article 33(2): “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.” There is no hour count for the vendor. The EDPB says the GDPR “does not provide an explicit time limit within which the processor must alert the controller, except that it must do so ‘without undue delay’”, and that it “recommends the processor promptly notifies the controller.”

Then the controller’s clock. The EDPB: “The controller uses the processor to achieve its purposes; therefore, in principle, the controller should be considered as ‘aware’ once the processor has informed it of the breach.” So the 72-hour clock in Article 33(1), which is owed to the supervisory authority and applies “where feasible,” starts when the vendor tells you. A slow vendor therefore delays your clock, but not your customers’ exposure, and the delay is the vendor’s to answer for: the FTC’s account of Blackbaud includes a wait of nearly two months before it notified its customers.

Can the vendor notify for you? Only if you authorize it, and it does not move the duty: “A processor could make a notification on behalf of the controller, if the controller has given the processor the proper authorisation … However, it is important to note that the legal responsibility to notify remains with the controller.” When one vendor breach affects many customers, the EDPB says “the processor will have to report details of the incident to each controller.”

Article 28(3)(f) is where you make this enforceable: the processor contract must stipulate that the processor “assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36,” which includes Articles 33 and 34.

HIPAA: business associate to covered entity

HHS: “A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach.” And on who answers to patients: “while the covered entity is ultimately responsible for ensuring individuals are notified, the covered entity may delegate the responsibility of providing individual notices to the business associate.” A 60-day outer limit for the vendor is long. Your contract should say something shorter. The HHS page we read was last reviewed July 26, 2013, so check the regulation text at 45 CFR 164.400-414.

California: vendor to owner “immediately”

Civil Code 1798.82(b): a business “that maintains computerized data that includes personal information that the individual or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery.” The owner’s own duty is then in subdivision (a): disclosure “within 30 calendar days of discovery or notification of the data breach,” effective January 1, 2026. The statute names notification as a trigger, so a vendor’s notice starts your clock.

Sources: GDPR Article 33, Article 28, EDPB Guidelines 9/2022, HHS, Breach Notification Rule, California Civil Code 1798.82.

For the wider set of clocks, including the SEC’s four business days after a materiality determination and the FTC Safeguards Rule’s 30 days, see the first 72 hours after a breach goes public. Whether a vendor’s incident counts as your own cybersecurity incident for Form 8-K purposes is a question we did not verify; put it to securities counsel.

What Blackbaud shows

Blackbaud sells donor data management software; the New York Attorney General lists its affected customers as including charities, colleges and universities, and health care organizations. The primary record, in order:

• Early 2020: the FTC says “a hacker in early 2020 exploited weaknesses in Blackbaud’s networks, which went undetected for three months, allowing the hacker to remove massive amounts of unencrypted sensitive consumer data belonging to Blackbaud’s customers.”
• July 16, 2020: Blackbaud announced that the ransomware attacker did not access donor bank account information or social security numbers. The SEC says that within days, the company’s technology and customer relations personnel learned the attacker had in fact accessed and exfiltrated it. The SEC also says the company “omitted this material information about the scope of the attack” from an August 2020 quarterly report.
• The scale: the SEC says the attack “impacted more than 13,000 customers.” The New York Attorney General describes “over 13,000 institutions that were Blackbaud customers and millions of their respective consumer constituents,” and says Blackbaud “paid the threat actor a ransom and was provided evidence that the stolen data was deleted.”
• The customer notice: the FTC says Blackbaud “waited nearly two months to notify its customers about the breach and then misled consumers about the extent of the data that was stolen, according to the complaint.”
• March 9, 2023: the SEC announced a $3 million civil penalty for misleading disclosures about the attack. Blackbaud agreed to the order “without admitting or denying the SEC’s findings.”
• October 5, 2023: a multistate coalition announced a $49.5 million settlement. Blackbaud’s own release says it was “with 49 state Attorneys General and the District of Columbia,” and that it agreed “not to make misleading statements related to its data protection, privacy, security, confidentiality, integrity, breach notification requirements and similar matters.”
• May 20, 2024: the FTC finalized its order. Blackbaud “is required to delete data that it no longer needs to provide its products or services and is prohibited from misrepresenting its data security and data retention policies.” It “also requires Blackbaud to notify the FTC if it experiences a future data breach that it is required to report to any other local, state, or federal agency.”

The line that matters most for customers is in the New York Attorney General’s release. Following the breach, Blackbaud “neglected to provide its customers with timely, complete, or accurate information regarding the breach, as required by law,” and as a result “notification to the consumers whose personal information was exposed was significantly delayed or never occurred at all, as Blackbaud downplayed the incident and led its customers to believe that no notification was required.”

Read that as a customer. The obligation to tell donors, patients and students sat with the institutions. The vendor’s incomplete account shaped whether and when they did it. The settlement terms respond to exactly that: they include “Updating breach notification provisions that require Blackbaud to provide appropriate assistance to its customers and support customers’ compliance with applicable notification requirements in the event of a breach,” plus “total database encryption and dark web monitoring” and “third-party assessments of Blackbaud’s compliance with the settlement for seven years.”

Sources: FTC press release, May 20, 2024, FTC case page, SEC press release 2023-48, New York Attorney General, Blackbaud, October 5, 2023. We read the agencies’ press releases, not the underlying complaint or the SEC order itself.

How the blame lands on the customer-facing brand

This section is our analysis, built from the legal structure above. No source we read measured how consumers or donors attributed blame in the Blackbaud matter.

1. The notice comes from you. Under each regime above, the owner, controller or covered entity is the party that tells individuals. So the person’s first contact with the incident is a letter with your name on it, or, if the notice is late or never comes, a news story or the California Attorney General’s public breach list. In both cases your name is the one attached.
2. The vendor stays offstage. Individuals rarely know the supplier. Whatever you say about it is the only explanation they receive.
3. The responsibility is not transferable. The EDPB says “the legal responsibility to notify remains with the controller,” and HHS says the covered entity is “ultimately responsible.” Public statements that read as passing the blame sit badly with that.
4. A vendor’s downplaying becomes your timeline problem. The New York Attorney General’s finding is the example: customers were led to believe notification was not required, and consumer notices were delayed or never occurred.
5. The review wave lands on your profiles, not the vendor’s. Google, Yelp and Trustpilot pages belong to the customer-facing business. Our companion guide on reviews after a breach notice covers what the platforms will and will not remove.

Your first 72 hours after a supplier’s notice

This is our recommended sequence. The legal deadlines belong to counsel.

Hours 0 to 12.

• Record the exact time and channel by which the vendor told you. It is the likely start of your GDPR awareness and of California’s “notification” trigger. Open one incident log.
• Ask for facts in writing: which of your data sets were involved, categories and approximate numbers of people, dates, whether the data was encrypted, whether it was acquired or only accessible, and what the vendor has done. These map onto the content GDPR 33(3) requires you to give a regulator.
• Do not repeat the vendor’s reassurances as your own until you have verified them. Blackbaud’s July 2020 statement is the cautionary tale.

Hours 12 to 36.

• Decide with counsel which clocks apply to you and when each started.
• Decide whether the vendor may send notices on your behalf. Under GDPR it needs your authorization and the duty stays yours; under HIPAA you may delegate to the business associate but remain ultimately responsible. If you delegate, approve the text.
• Draft your own individual notice. California’s required headings (What Happened? What Information Was Involved? What We Are Doing, What You Can Do, For More Information) give you a clear structure.

Hours 36 to 72.

• Send direct notices. The EDPB says a press release or corporate blog alone “would not be an effective means of communicating a breach to an individual.”
• Publish an owned page with plain-language answers and the channels through which you will, and will never, contact people.
• Say plainly that a service provider you use was breached, and say what you are doing for the people affected. Whether to name the vendor is a legal and contractual decision, and nothing we read requires it. Avoid language that reads as blaming the vendor for your obligations.
• Brief the people who will answer the phones and the review replies with the same text.

Fix the contract before the incident

The settlement terms and the statutes point to a short checklist for any vendor holding personal data:

• A notification deadline shorter than the legal outer limits, in hours or one to two business days from the vendor’s discovery, plus an obligation to give scope facts and update them. The law’s outer limits for vendors are “without undue delay,” “immediately following discovery” in California and 60 days in HIPAA.
• Assistance obligations. GDPR Article 28(3)(f) requires it. The Blackbaud settlement shows regulators treat the lack of it as a failure.
• Audit rights. Article 28(3)(h): the processor “makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections.”
• Sub-processor control. Article 28(2): “The processor shall not engage another processor without prior specific or general written authorisation of the controller.” And Article 28(4): the initial processor “shall remain fully liable to the controller for the performance of that other processor’s obligations.”
• Deletion and minimization. The FTC’s order against Blackbaud requires it to delete data it no longer needs. Ask your vendors what they retain after the service ends, and ask for return or deletion at termination (Article 28(3)(g)).
• Encryption. The FTC alleges the data taken was unencrypted. Article 34(3)(a) shows why encryption matters on your side as well: you may not have to notify individuals if the data was protected by measures “such as encryption.”

Where a reputation team fits

The legal work and the vendor negotiation belong to counsel. The public layer, meaning the owned page, press handling, search monitoring and review replies, runs in parallel from the hour the vendor’s notice arrives. That is the work of our Crisis PR, Reputation Monitoring and Business Reputation Management engagements.

If the people exposed include your executives, the other half of this story is in what to do when your own license, email and address leak.

The 90-second audit shows how exposed your reputation is before an incident. The strategy call is free. This article is general information, not legal advice.