South Dakota Privacy Enforcement Cases

Why the action was brought

Blackbaud’s 2020 data breach exposed the personal and financial information of consumers connected to more than 13,000 customers. The lawsuit alleged that Blackbaud violated state consumer protection, breach notification, and HIPAA requirements, failed to implement reasonable data security, did not remediate known security gaps, and failed to provide timely, complete, or accurate breach information.

Why the action was brought

Equifax’s 2017 data breach exposed social security numbers, names, dates of birth, addresses, credit card numbers, and some driver’s license numbers of more than 147 million consumers. Equifax failed to maintain a reasonable security system, patch a critical software vulnerability, and replace monitoring software, allowing attackers to remain undetected for 76 days.

Why the action was brought

Cyber attackers accessed Target’s gateway server through credentials stolen from a third-party vendor, exploited weaknesses in Target’s system, accessed a customer service database, installed malware, and captured full names, telephone numbers, email and mailing addresses, payment card numbers, expiration dates, CVV1 codes, and encrypted debit PINs, creating potential financial harm.