[TheOtherHobbes]

The incentive to pay is that it nukes Blackbaud's credibility and trustworthiness, and likely destroys the entire business.

To a criminal that's easily worth an ask of 5BTC - or perhaps x% of annual profits in perpetuity.

An extortion scam is likely to be worth more than the data.

[toyg]

Reputational damage happens anyway, once news of the first breach/ransom goes out (which it will, it’s increasingly mandated by law). Second time around they might as well fold.

A prolonged extortion scheme can only be done on a low-scale highly-targeted basis, where you can ensure word doesn’t get out.