July 28, 2020
Hello Nonprofit Leaders and Supporters,

Last week I mentioned that there are some scammers and spammers hitting Oregon right now to try to take some of the hard “worked-for” funding that you all need. Sadly, I have more news to share in that regard. Some of you have already been alerted that  Blackbaud , the fundraising software company with products like  eTapestry  and  Raiser’s Edge  experienced a major security breach in which nonprofit data was stolen.

In May 2020, Blackbaud discovered and stopped a ransomware attack. In a ransomware attack, cybercriminals attempt to disrupt the business by locking companies out of their own data and servers. Blackbaud is just now notifying their clients regarding the extent of the breach.

After discovering the attempted attack, their cybersecurity team – together with independent forensics experts and law enforcement – successfully prevented the cybercriminal from blocking their system access and fully encrypting files, and ultimately expelled them from the Blackbaud system.

 Prior to the successful expulsion, the cybercriminal removed a copy of a subset of data from their self-hosted environment. According to Blackbaud, the cybercriminal did not access credit card information, bank account information, or social security numbers. Blackbaud paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed.

Based on the nature of the incident, their research, and third party (including law enforcement) investigation, they state that they have no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly. In accordance with regulatory requirements, Blackbaud began notifying all organizations whose data was part of this incident and are providing resources and tools to help them assess this incident.

Blackbaud has created a  resource page  for you at  www.blackbaud.com/incidentresources  that features a toolkit with a step-by-step guide to help you as you digest this information. It also contains answers to key questions, links to educational webinars information about their future plans, and other resources.

To ensure all your questions are answered as quickly as possible, Blackbaud encourages nonprofits to first review the resources they’ve provided at the link above. If you still have questions after reviewing these resources, please contact the dedicated team they have established for this incident:

North America: 1-855-907-2099 between 9 a.m. and 9 p.m. ET Monday – Friday

Oregon law requires businesses (including nonprofits)  and state agencies to notify any Oregon consumer whose personal information was subject to a breach of security. In the event that a breach affected more than 250 Oregon consumers, the law also requires that a sample copy of a breach notice sent to more than 250 Oregon consumers must also be provided to the Oregon Attorney General. Based on Blackbaud’s statement that the cybercriminal did not access credit card information, bank account information, or social security numbers, it is unclear if nonprofits using Blackbaud products and meeting the 250 Oregon consumer (think givers in your fundraising database) would need to report. It would be best to check directly with Blackbaud if your product was compromised and seek the advice of an attorney on consumer notification in your particular case.
In Oregon

As a reminder, Governor Brown expanded restrictions last week in the face of a spike in COVID-19 cases in Oregon. Masks, face shields or face coverings are currently required statewide for  indoor public spaces  (for example, grocery stores, pharmacies, public transit, personal services providers, restaurants, bars, retail stores, and more). In addition, face coverings are required in  outdoor public spaces  when physical distancing is not possible.

Starting July 24: Children ages 5 and up are required to wear masks, face shields, or face covering. Face coverings are now required when exercising indoors, plus outdoors when physically distancing is not possible.

People with disabilities or medical conditions may request accommodation from the business if they cannot wear masks, face shields, or face covering.

For a complete update and the latest information on requirements, check the  Oregon Health Authority website and  NAO COVID-19 Resources page .
At the Federal level

Yesterday, Senate Republicans formally unveiled their  roughly $1 trillion stimulus proposal . Senate Majority Leader Mitch McConnell said In comments on the Senate floor, "The American people need more help," and that the GOP proposal will be called the HEALS Act (Health Economic Activity Liability protection Schools).

The bill will include a variety of component parts, which GOP senators and committee chairs rolled out in a series of floor speeches Monday evening, including liability protections, a second round of direct payments to Americans and a second round of Paycheck Protection Program loans intended to help keep the hardest-hit small businesses afloat.

A coalition of national organizations has released a  coalition statement upon release of the detail . There are several big items the nonprofit sector has been looking for in the HEALS Act: 

  • Expanded Employee Retention Tax Credit [Sec. 211]: Similar to the HEROES Act, the bill would increase the CARES Act refundable payroll tax credit to 65% of wages (up from 50%) of up to $10,000 per quarter (currently per year), meaning the value per employee would be $19,500 rather $5,000 under current law. The bill also would allow employers to claim the credit for every employee up to 500 workers (current law cap is 100 employees). Regarding eligibility, the bill would lower the amount of the decline in gross receipts required to qualify as an eligible employer from a 50- percent decline to a 25-percent decline compared to the same calendar quarter in the previous year.

  • 75% federal coverage of unemployment costs of self-insured employers (up from 50%; not the 100% we need) [Sec. 102] The coalition statement says: “Massive unemployment bills may force self-insured nonprofits to lay off even more workers; anything short of full coverage of unemployment costs is a jobs killer for nonprofits because state unemployment bills are due and payable this month. 100 percent coverage of unemployment costs for self-insured nonprofits must be included in the relief package.”

  • Safe and Healthy Workplace Tax Credit [Sec. 213]: Would create a refundable payroll tax credit to reduce the costs incurred for COVID-19 testing, personal protective equipment (PPE), disinfecting, extra cleaning, and reconfiguring workspaces. The credit would apply at a rate of 50%, capped at $1,000 per employee (up to 500 employees), $750 (between 501 and 1,000 employees), and $500 (more than 1,000 employees). The credit could be applied retroactively to qualified expenses going back to March and forward through December.

  • Above-the-Line Deduction: No improving language included in this draft. The CARES Act already allows for a $300 “Above-the-Line Charitable Donation.” In other drafts of the stimulus package that is currently being negotiated, there are proposals to expand the above-the-line deduction for charitable giving even further.  

Small Business Provisions

  • PPP Improvements: The bill would expand the types of expenses that are forgivable [Sec. 101], give borrowers the choice of which eight-week period to use for seeking forgiveness [Sec. 103], ease the application process [Sec. 104], and ensure that group insurance costs count as payroll costs for forgiveness purposes [Sec. 105]. 

  • PPP Second Draw Loans [Sec. 106]: Allows borrowers a second round of a PPP loan, so long as the nonprofit has 300 or fewer employees and experienced reduced gross receipts in the first or second quarter of 2020 compared to the same quarter of 2019. Loans would again be based on 2.5 times average monthly payroll, but would be capped at $2 million. Borrowers that received more than that amount in the first round would not be eligible for a second draw. [Sec. 107]

  • Other Provisions: Would expand access to loans to mutual benefit nonprofits formed at 501(c)(6) organizations [Sec. 113] and provide that PPP loan proceeds cannot be used for lobbying [Sec. 114]

  • Appropriations: The bill calls for rescinding $100 billion previously authorized under the CARES Act and authorizes $190 billion for the PPP and the PPP Second Draw Loans.

NAO will be working with national nonprofit coalition leaders on getting more details on the negotiations and sharing those with you all as soon as possible.
Upcoming Online Sessions for Nonprofits  

15-Minute Resiliency Practice Sessions for the month of July, Tuesdays from 5:30 – 5:45 p.m. and Thursdays from Noon – 12:15 p.m. PT: Systems change work requires longevity. In order for our racial justice work to be sustainable over the long haul, we need to practice regulation skills that support our nervous systems. Living Yoga, NAO nonprofit member, is offering these short, accessible, free, and open-to-anyone Resiliency Practice Sessions. Each session includes four simple movements and breath practices that can be done anywhere - no props or anything needed to participate. Living Yoga trainers connect the practices to our need for grounding, and support us in accessing our resiliency as we deal with acute stress and sustain our efforts to interrupt racism and oppression. More information and links to the Tuesdays/Thursdays sessions  here.

Help Employees Repair and Reset Their Retirement Plan, Thursday, July 30, 10 – 11 a.m. PT: Nonstop Wellness, an NAO member benefit partner, is hosting a webinar building a foundation of general financial health, helping employees to stay the course, retirement savings in the midst of a pandemic, and meeting employees where they are in their financial life. Register for the session  here.

Ask the Experts: Maximizing Loan Forgiveness Under the Paycheck Protection Program, Wednesday, August 12, Noon – 1 p.m. PT: Many nonprofits who received loans under the Small Business Administration’s Paycheck Protection Program are now dealing with how to best navigate the complexities of maximizing their loan forgiveness. In this session, Lisa Fajardo Faust – Senior Vice President and Relationship Banking Team Leader at Pacific West Bank, Robert Countryman – Market President for Portland/Seattle at First Interstate Bank, and Lesley Bennett – Senior Financial Consultant at CFO Selections will discuss practical steps, processes, and documentation that nonprofits should follow to ensure the best outcomes for their organizations. They will provide guidance on the approach, processes, and procedures that nonprofits should implement as they see it from their vantage points as a professional at a lending institution that transacted the PPP loans and a finance practitioner. Register for the session  here.

Mark Your Calendar ! The Ultimate Grant Proposal Blueprint Course: Your Step-by-Step Roadmap and Built-It-Yourself Toolkit for Crafting an A+ Grant Proposal, an eight-week online course scheduled from August 24-October 26: In this comprehensive, on-your-own-schedule video-based, course from GrantsMagic U, veteran grant writer, grant consultant, and grantmaker Maryn Boess pulls back the curtain on what it really takes to be successful in the grants world. She will share hundreds of tried-and-tested tools, strategies, how-to's and "insider's tips" to take you to your next level of grants success no matter where you're starting out. Registration for the course here.
Stay safe and healthy.

Jim White
Executive Director
Thank you to the following SUPPORTERS and SPONSORS who are supporting NAO’s online COVID-19 events and communications during these challenging times. Their support is vital in helping NAO to bring much-needed resources and information to Oregon’s nonprofits – thank you.