Up-to 4% of their global revenue or €20,000,000 whichever is higher. Those are the maximum fines they can levy (per incident), but in reality it's very unlikely to be that high.

And yes, you are correct, organisations have 72 hours to disclose the breach.

The various data protection offices (such as the ICO in the UK) usually try to work with organisations first. If Blackbaud aren't playing ball though, they may be in for a rough ride (assuming that they actually operate where the EU has jurisdiction that is).