Nonprofits Beware: Cybercriminals Don’t Take Charity
As a nonprofit organization, you are likely facing many challenges in managing your day-to-day operations. But one challenge that is growing and may often be overlooked or underestimated is cybersecurity. While your organization works hard to make a positive impact in the community, cybercriminals may see your organization as an attractive target with access to valuable financial and donor-related data.
Nonprofits have generally limited resources and personnel making the organizations particularly vulnerable to cybersecurity incidents. Whether it is phishing emails, the existence of weak passwords, outdated software, data breaches, malware, or vulnerabilities of third-party vendors, these risks are present in the current business environment for any entity regardless of their size and they could have a significant impact on your organization and the people you serve.
The great news is that there are actions you can take to safeguard your organization to limit the exposure:
- Phishing emails:
One of the most common threats are phishing emails. Cybercriminals will send your employees emails that look legitimate, containing harmful links and attachments requesting for your employees to share sensitive information or login credentials. To prevent this, it is essential for the organization to educate its employees about how to identify and respond to these suspicious emails. Generally, running mock phishing exercises gives everyone in the organization a chance to learn how to recognize these threats in a safe, supportive way. Such education is one of the most cost-effective preventive steps your organization can take. - Password controls and access:
Your organization’s security starts with strong passwords. Encourage your team to use complex, unique passwords for each system and enforce multi-factor authentication wherever possible. A system that requires multiple forms of verification—like a password and a text message code—adds a critical layer of protection. Regularly reviewing and monitoring accounts for unusual activity can also prevent attacks before they escalate. We have all wondered why passwords must be so complicated and why they expire so often, especially when remembering the new ones feels like a challenge. But think of it this way: it’s a small but important way you contribute to keeping the organization’s data and access secure. - Regular software updates:
Life can get busy, and we may not think about the significance of the software updates. But regularly updating your software is one of the easiest and most effective ways to protect your organization. Updates patch known vulnerabilities and strengthen system defenses, making it harder for attackers to exploit outdated systems. Staying current on software updates ensures your organization is well-prepared to face new threats. Ensure you have a designated individual in the organization or at a third-party provider that stays current on all recent updates. - Third-party providers:
In today’s digital world, you likely rely on third-party platforms for donations, managing donor data, or collaborating with partners and vendors. While these tools are essential and help you automate some of your work, they can also introduce risks if their security is not up to standards. It is important to review the security measures of these vendors. Ask about their cybersecurity certifications and how they encrypt your data. Ensure the third-party provider has processes in place for safeguarding the sensitive information and that the access is restricted only to what is needed. - Social engineering:
With the continued rise of digital communication (social media), social engineering attacks, where attackers manipulate employees into revealing confidential information or taking unsafe actions, are becoming more common. These attacks can be subtle and convincing. Encourage a culture of vigilance and openness in your organization, where staff feels comfortable verifying requests or questioning suspicious activity.
The impact of cyber incidents could be significant on your operations. It is not only the financial loss or a breach of donor or employee data privacy, but it is also your organization’s reputation and the potential loss of trust in the community. In addition, this could impair your organization’s ability to secure future funding and attract new donors. And unfortunately, dealing with cyber security incidents can be time-consuming, pulling the already limited resources from the main focus and goal of the organization.
Training, IT safeguards, and organizational policies can help mitigate these risks. Providing training to staff and volunteers on how to identify potential phishing attempts and suspicious links, as well as promoting a trust but verify culture, can be low-cost preventative measures with high impact. Requiring strong passwords, implementing multi-factor authentication, and limiting access to sensitive information can provide additional safeguards. These considerations should be an integral part of the organization’s ongoing operational risk assessment.
Lastly, consider purchasing cybersecurity insurance. It will provide your organization an additional safety net and financial coverage as well as assistance with notifying the impacted parties in case of cybersecurity incidents.
About the Author
Helena Bouron
Helena Bouron, CPA, is an Assurance Principal and leads the ASL Nonprofit Group. She serves privately held businesses and organizations throughout the Bay Area. Her practice encompasses…
