The incident demonstrated that even highly respected humanitarian organizations are not immune to cyber threats. It also highlighted the unique risks nonprofits face when handling confidential information about donors, beneficiaries, volunteers and employees.
Nonprofits have become attractive targets for cyber criminals who have learned that these organizations often possess valuable data but have fewer cyber security resources than many private-sector businesses. And it’s not just large nonprofits that are targeted, and hackers typically prefer to go after small and mid-sized organizations that may not have the resources to mount strong cyber defense.
The consequences can be severe. A successful cyberattack can disrupt operations, expose sensitive donor and client information, damage an organization’s reputation and create significant financial costs. Nonprofits must comply with the same notification rules as businesses after suffering a data breach and may also face similar fines if they are found to have lax security.
Why criminals target nonprofits
Many nonprofits assume they are too small or too mission-focused to attract hackers. But the opposite is often true:
They store valuable data — Nonprofits frequently store highly sensitive information, including:
- Donor payment information
- Social Security numbers
- Health records
- Client and beneficiary data
- Employee information
Data can be sold on criminal marketplaces, used for identity theft or leveraged for extortion.
Less cyber security protection — Unlike large corporations with substantial technology budgets, many nonprofits operate with limited resources. As a result, they may lack:
- Advanced security software
- Dedicated IT security personnel
- Regular employee cyber security training
- Ongoing vulnerability testing
- Formal incident response planning
The path of least resistance — Attackers frequently look for the easiest way into a network. A nonprofit with weaker defenses may be a more accessible target than a larger organization with extensive security controls.
In some cases, hackers may use nonprofits to access partners, vendors or donor networks.
Recent nonprofit organization cyberattacks
- Connecticut-based National Association for Amateur Radio paid a $1 million ransom to unlock its network after it was compromised by hackers, locking employees out and making it difficult for the organization to operate. The money, along with the cost of restoration, was largely covered by their insurance policy.
- After hacking into the bank account of rescue horse and human therapy nonprofit Angel Horses Inc. in 2024, cyber criminals were able to access its bank account and steal $70,0000, almost bankrupting the Billings, Mo.-based organization.
- New York Blood Center, one of the country’s largest nonprofit blood donation and distribution centers, was forced to cancel appointments and blood drives after a March 2026 ransomware attack.
Common cyber security risks
Ransomware— Ransomware remains one of the most damaging threats facing nonprofits. Attackers infiltrate a network, encrypt files and demand payment to restore access. A ransomware attack can also halt fundraising efforts, disrupt communications, lock employees out of critical systems and prevent the delivery of services.
Data breaches — Hackers may access donor databases, financial information or confidential client records through phishing e-mails, stolen credentials or software vulnerabilities. Beyond the loss of information, data breaches can trigger legal obligations, regulatory scrutiny and costly recovery efforts.
Phishing and social engineering — Many attacks begin with a deceptive e-mail designed to trick employees into clicking a malicious link, opening an infected attachment or sharing login credentials. As artificial intelligence tools improve, phishing messages are becoming more convincing and harder to detect.
Operational disruptions — Cyberattacks can shut down websites, donation platforms and internal systems, preventing organizations from carrying out their missions.
Best practices
No organization can eliminate cyber risk entirely, but nonprofits can significantly reduce their exposure by taking several practical steps:
- Use strong passwords and require multifactor authentication.
- Keep operating systems, software and security tools updated.
- Install monitoring software that can alert management to a breach.
- Conduct regular employee training on phishing and social engineering scams.
- Back up critical data regularly and test restoration procedures.
- Perform periodic cyber security risk assessments.
- Develop and maintain a written incident response plan.
- Limit employee access to sensitive data based on job responsibilities.
- Evaluate the cyber security practices of vendors and third-party partners.
- Consider cyber liability insurance as part of a broader risk management strategy.
