Nonprofits have been targeted by hackers, with email-based cyberattacks increasing by 35.2% in the past year. These attacks are primarily aimed at stealing donor data, financial transactions, and internal communications.
According to a new report from Abnormal Security, nonprofit organizations are a good target for cybercriminals due to their limited cyber resources, limited cybersecurity , and frequent financial transactions.
Attackers exploit these weaknesses and carry out BEC (business email compromise) and VEC (vendor email compromise) attacks, tricking employees into sending money or giving up sensitive information.
See also: YouTube: New phishing scam uses deepfake video of CEO
According to Abnormal Security, the increase in cyberattacks on nonprofit organizations, especially via email, is partly due to the evolution of social engineering.
Hackers are creating highly targeted phishing emails that bypass traditional security filters. They often impersonate donors, regulators, or partner organizations. The rise of digital fundraising and online collaboration tools further expands the attack surface.
Nonprofits: Phishing and malware attacks on the rise
According to the report, Credential phishing, which allows attackers to steal login credentials and gain access to donor databases, has increased by 50.4%.
By gaining access, hackers can steal internal communications, commit financial fraud, or steal sensitive data and sell it to other fraudsters. Nonprofits are particularly vulnerable due to their reliance on volunteers and external partners, who may not have cybersecurity training.
See also: Phishing: Fake CAPTCHAs deliver Lumma malware
Researchers observed that malware distribution have also increased by 26.2%, with malicious attachments posing as invoices, sponsorship approvals, or donor lists. These files contain malware that can lead to ransomware incidents, data breaches, or operational disruptions.
Strengthening cyber defense
Nonprofit organizations must take preventive measures to protect themselves from the above threats.
Creating a culture of safety
- Training staff and volunteers in basic cybersecurity practices (phishing awareness, password security, etc.).
Use strong passwords and multi-factor authentication (MFA)
- Require strong, unique passwords for all accounts.
- Enable MFA in email, cloud storage, and donor management systems.
Regular software updates
- Regularly update all software, including operating systems, browsers, and plugins.
- Use automatic updates where possible.
Data Encryption & Backup
- Encrypt sensitive data both in transit and at rest.
- Regularly back up critical data and store it offline or in a secure cloud service.
Restricting access to data
- Follow the principle of least privilege—give employees only the access they need.
- Regularly review and revoke access for former employees or volunteers.
Secure Communication Tools
- Use encrypted messaging platforms (like Signal or ProtonMail) for sensitive conversations.
- Avoid sharing sensitive information via email unless absolutely necessary.
Antivirus & Firewalls
- Use reliable antivirus software and enable firewalls on all devices.
Incident Response Plan
- Create a step-by-step plan for responding to cyberattacks.
- Assign roles and train staff on how to react in the event of a breach.
Regular Security Checks
- Conduct regular risk assessments to identify vulnerabilities.
- Use tools like Have I Been Pwned to check if your organization's emails have been compromised.
See also: Phishing attacks distribute FatalRAT malware
Abnormal Security also recommends using solutions AI-powered email security, which can help detect and block advanced attacks early. These tools leverage behavioral analysis and machine learning to identify suspicious signs and prevent breaches.
Protecting donor data, securing financial transactions , and maintaining public trust are vital for nonprofits.
Source: www.infosecurity-magazine.com
