Why Nonprofits Are Attractive Cyber Targets and What Leaders Should Do About It

Donors trust a nonprofit with their payment details, and the people it serves trust it with their medical records, family circumstances and financial histories. Cybersecurity for nonprofits is about keeping that trust intact, because the same information that makes the work possible also makes an organization worth targeting. Much of the protection starts with leadership decisions, well before any new technology is involved. 

Why Nonprofits Make Attractive Targets

Many nonprofits combine two things attackers look for: valuable information and limited resources to protect it. Donor records often include names, addresses and payment details, while client files can hold medical, financial or family information that’s protected by law. Money moves constantly through online donations, event registrations and grant disbursements.

Many organizations also depend on part-time staff and volunteers with access to shared systems, along with outside vendors for bookkeeping, payroll or donation processing. The culture can work against them as well. Nonprofits run on goodwill, and a fake email that appears to come from the executive director or a longtime vendor is easier to believe in an organization where people are used to trusting each other. Size offers little protection either, since many of these scams go out to thousands of inboxes at once.

The Real Cost Is Donor and Funder Trust

The damage from a breach at a nonprofit reaches well beyond the systems involved. Donors who learn their information was exposed may give less or stop giving, and even data that seems low-stakes, such as event attendance or giving preferences, can hurt an organization’s reputation once it gets out.

Grant funding raises the stakes further. Organizations that receive federal awards are expected to protect sensitive information as part of their internal controls, so a breach can become a compliance issue as well as a public relations problem. Money can also be lost directly. A fraudulent request to change a vendor’s bank details or redirect a grant payment can drain funds that were meant for programs. Recovery costs add up quickly as well, from notifying affected donors and clients to restoring systems and answering questions from funders.

Start With What You Collect and Who Can Reach It

The simplest way to reduce risk is to hold less information. An inventory of what the organization collects, where it’s stored and who’s responsible for it can turn up records no one needs anymore, and a clear document retention policy sets rules for disposing of them. From there, a few practical steps close the most common gaps:

• Limit access to what each person needs for their role, including volunteers
• Remove access promptly when staff or volunteers leave
• Require multifactor authentication (MFA), which asks for a second proof of identity at login, on email, donor databases and financial systems
• Confirm any request to change banking details or redirect a payment by calling a phone number already on file
• Ask vendors that handle donor or client data how they protect it

None of these steps requires a large budget, and together they make an organization a much harder target.

Make Cybersecurity a Board-Level Conversation

Boards oversee risk, and cyber risk belongs on that list alongside fraud, compliance and reserves. A short, regular report from staff on training, access reviews and any incidents gives board members what they need without turning meetings into technical briefings. Cyber liability coverage belongs in the same review, since policies can help pay for costs like notifying affected donors and restoring systems, and the right policy depends on how the organization operates.

Funding is often the harder conversation. The National Council of Nonprofits encourages organizations to move past the old overhead myth and speak openly with donors and funders about investing in security, including in grant proposals and reports that explain how donor and client information is protected. The Council also points out that it takes only one person clicking a phishing link to undo the best system, which is why training has to reach everyone on staff. Building security into the annual budget treats it as part of delivering the mission.

Protect the Trust Behind the Mission

Every dollar a nonprofit raises depends on people believing their money and information are in good hands. Treating cybersecurity as part of stewardship, reviewed by leadership and budgeted like any other essential cost, protects that belief. Cybersecurity Awareness Month in October is a natural time to start.

James Moore Technology Services helps nonprofits protect donor data, funding and the trust behind both. Contact us when you’re ready to talk through where your organization stands.

All content provided in this article is for informational purposes only. Matters discussed in this article are subject to change. For up-to-date information on this subject please contact a James Moore professional. James Moore will not be held responsible for any claim, loss, damage or inconvenience caused as a result of any information within these pages or any information accessed through this site.