Nonprofits Are Prime Targets for Cyberattacks – 3 Ways to Stay Cybersafe on a Budget

Cyberattacks against nonprofits are on the rise. Often, nonprofits lack the time or resources to reduce the impact of these threats. Before we jump to the solution, let’s look at some of the most common attacks experienced by nonprofits in 2025: 

Nonprofit Cyberattack: The ‘CEO’ Message Trap  

Imagine this: Lucy, the fundraising manager at your nonprofit gets a message from the ‘CEO’ Mark that she urgently needs to update her account details. It’s right before pay day. Lucy see’s it’s from Mark, she’s in a rush, and panics about the message, thinking she won’t get paid in time. She quickly opens the link without thinking and inputs her account details. Lucy thinks nothing of it and moves on with her day. Until later she gets a call from her bank saying her account has been compromised. She is now $1000 down, not having realised that the message from Mark was a hacker.  

Nonprofit Cyberattack: The 'HR’ Email 

Months later, Mark, the CEO, is going through his inbox in the evening. It’s been a long day, filled with endless board meetings, and he’s trying to get his inbox down to 0. He’s already dealt with 28 emails. He opens the one from HR titled: Photos from last week's team building. Mark gets excited, finally an email with something that doesn’t evoke stress! He opens the link to the view the photos. But now his computer starts to glitch. By clicking the link from 'HR', a malware was downloaded onto his system. Mark sighs and bangs his forehead into his palms. He realises his whole nonprofit is now compromised.  

These stories might sound made up, but they're adaptations of real cyberattacks we've seen. Wondering why nonprofits are targets, and how to protect yours? This article will help.  

Why are Nonprofits being Targeted for Cyberattacks?  

Nonprofits are easy targets because they're seen as lacking resources, budget, and security. They get targeted because they are smaller and may be easier to hack into. Here is the hard truth:   

• 1 in 4 nonprofits have been hacked 
• 68% have no incident response plan, and  
• 60% of small organisations that experience a cyberattack go out of business within six months. 

Luckily, the majority (76%) of data breaches involve human error.  

You may be thinking – how is that lucky? Well, since most breaches involve human error, the solution revolves around minimising human error. With the right steps, this can be budget friendly. You can save your nonprofit from harmful cyberattacks, without reducing other essential spending. 

Talk to us about this 

Here’s 3 Ways to Keep your Nonprofit Safe from Cyberattacks

1. Password Protection 

Strong passwords prevent hackers from gaining access to your data. You want to ensure that your staff aren’t using the same, weak password for everything, or even worse... Saving them straight to their browser!  

How to Improve Password Protection: 

Ensure staff passwords are safe, encrypted, and not stored on browsers. 

• Use apps like LastPass to create and save strong passwords so you don’t have to remember them all. 

• Turn on multi-factor authentication (MFA) for extra protection. 

• Change passwords often and remove old accounts when staff leave. 

  ---

   

How to keep it Budget-Friendly: 

• Nonprofits can access discounted or free versions of password managers like Dashlane or 1password 

• Whatever you do, don’t create one account and share the access – that's essentially undoing the benefit of a password manager in the first place! 

2. System Security 

Your nonprofit needs strong security measures to prevent breaches. Think about it like locking all the doors and windows in your house 

Steps to Secure Your System: 

• Conduct a cybersecurity audit to identify where you are vulnerable  

• Ensure your firewalls and antivirus software are up to date. 

• Use Microsoft Secure Score to assess and improve security.  

   

“Microsoft Secure Score is a measurement of an organisation's security posture, with a higher number indicating more recommended actions taken. Find it at https://security.microsoft.com/securescore in the Microsoft Defender portal.” 

How to keep it Budget-Friendly: 

• Free tools like Microsoft Defender for cloud enhances protection at the foundational level. 

3. Staff Training

76% of cyber breaches involving human error. You could reduce this percentage by training staff to recognise cyber threats. No more clicking suspicious links!  

What Should You Include in Cybersecurity Training?  

• How to spot a cyberattack: 

• Suspicious sender names and email addresses 

• Spelling mistakes or odd phrasing 

• Urgent messages demanding immediate action 

• How to report a cyberattack to prevent further damage. 

• Simulated phishing attacks to help staff recognise real threats. Our IT team runs these monthly to train employees and help us remain vigilant. 

  ---

   

Budget-Friendly Tips: 

• Free or low-cost online cybersecurity training programmes are available for nonprofits. 

• Conduct short 30-minute training sessions to keep staff informed without disrupting operations. 

• Implement phishing attack simulations which have a low cost and a high reward.  

If you only take one thing out of this article, it would be this:  

Cyberattacks on nonprofits often succeed because of human error. The good thing? Protecting your organisation doesn’t have to break the budget. Strong passwords, updated security systems, and basic staff training can go a long way. Small steps = big protection.