Most privacy law in the United States was written for companies, and a lot of it says so in the definition at the top. A 501(c)(3) reads that definition, finds itself outside it, and concludes the sector got a pass. It did not. The statutes that grant the exemption are the ones about selling data and answering consumer requests. The statutes that impose the cost after something goes wrong, breach notification, are written to cover any organization holding a resident's personal information, and they do not ask what your tax status is. A nonprofit therefore carries close to the full downside of a data breach with almost none of the compliance scaffolding that would have made it prepare. That asymmetry, not the size of the budget, is what makes securing a charity a distinct problem.
Why Cyber Security for Nonprofits Is Different
Three facts about this sector explain almost every sensible spending decision inside it.
The first is that it is not small. The Bureau of Labor Statistics research series on the sector counts over 300,000 nonprofit establishments accounting for 12.8 million jobs, or 9.9 percent of all private-sector jobs in 2022. An attacker does not see a cause. It sees a payroll, a bank account and a customer database.
The second is where those people work. The BLS spotlight on employment by class of worker records that in 2022, education and health services accounted for 65.0 percent of nonprofit workers. Two thirds of the sector's staff already sit inside health care or education, which means two thirds of nonprofit employees work somewhere a sector-specific rule already applies. The organizations that believe no regulation touches them are, statistically, the minority.
The third is that the federal government treats the sector as high risk and under-resourced rather than as unregulated. CISA runs a directory of volunteer cyber help for what it calls target-rich, cyber-poor high-risk communities, and on May 14, 2024 it published joint guidance for civil society with DHS, the FBI and international partners aimed at nonprofit, advocacy, cultural, faith-based, academic, journalist, dissident and diaspora organizations. Guidance is not a rule. It is an acknowledgment that these organizations get attacked by people who are not amateurs.
What Data Nonprofits Hold and Why Attackers Want It
A mid-sized charity's database is a strange, valuable object. It holds current addresses and phone numbers for people who have already proven they give money away, notes on their capacity to give more, a payment history, and often the beneficiaries too, whose records can include immigration status, medical need, addiction history or the address of a shelter.
That last category is the one nobody prices correctly. Donor data leaking is expensive. Beneficiary data leaking can be dangerous to a specific person, and the organization holding it is frequently the only party that understood the risk in the first place.
The record itself rarely sits in one place, which is where the sector's exposure actually lives.
Every ring in that diagram is a place the record can leave from, and only two of them are under your direct control. This is the difference between a nonprofit's exposure and a small retailer's: the retailer's data mostly sits where the retailer put it, while a charity's most complete profile of a person usually lives in a system it rents. Understanding what counts as a breach matters more here than in most sectors, because the incident that puts your name in the news may well happen on somebody else's network.
What Regulations Apply to Nonprofit Cyber Security
There is no HIPAA for charities, no SEC filing, no sector examiner. What exists instead is a patchwork that attaches to activities rather than to tax status, and one very consequential split.
Every state now has a breach notification law of its own shape, with its own definition of covered information, its own deadline and its own reporting threshold, and a national charity with donors in forty states can be operating under forty of them at once.
Three obligations catch nonprofits that assume they have none.
The first is health care. Roughly two thirds of the sector's workers are in education and health services, and a nonprofit clinic, hospice, behavioral health provider or community health center is a covered entity like any other. HIPAA's Security Rule and its 60 day notification clock apply in full, with no discount for the mission.
The second is card payments. Accepting donations by card puts an organization inside PCI DSS obligations through its merchant agreement rather than through a statute. Using a hosted donation page shifts most of the work to the processor, which is exactly why building your own payment form is a decision worth refusing.
The third is the one unique to this sector, and it runs through the IRS. Form 990 asks in Part VI, alongside the conflict of interest and whistleblower questions, whether the organization has a document retention and destruction policy. That question is not a security control on its face. It becomes one the moment you notice that the single cheapest way to shrink a breach is to be holding less data when it happens, and that the sector's own annual filing already asks the board whether it decided how long to keep things.
How a Nonprofit Data Breach Gets Reported
The reporting path is where a nonprofit's position differs most sharply from a company of the same size, and it is worth walking before an incident rather than during one.
The office that receives a breach notice is generally the state attorney general, and in most states the charities bureau that holds an organization's solicitation registration sits inside that same department. A company reporting a breach is talking to a consumer protection regulator. A charity reporting a breach is talking to a consumer protection regulator that also has a file on whether it may keep asking the public for money. Nothing in the statute links those two things. Everything in practice does.
Funders are the second audience, and the deadline is often tighter than the law's. Federal grant terms, foundation agreements and government service contracts routinely carry incident notice clauses measured in days. The board is the third, and a board that hears about a breach from a journalist is a governance problem on top of a security one.
The Cyber Attacks That Actually Hit Nonprofits
Vendor pages list every threat that exists. The attacks that reliably land on charities are narrower, and two of them run on information the sector is required by law to publish.
A nonprofit's Form 990 is a public document. It names the executive director and the finance officer, gives the fiscal year, states the revenue, and describes the largest program. An attacker researching a company has to guess at that. An attacker researching a charity downloads it.
- Read the public filingOfficer names, titles, revenue and program detail, free and legal
- Pick the pairUsually the executive director and whoever actually releases payments
- Register a near-miss domainOne character different, or a free mailbox using the real name
- Send the requestA grant disbursement, a vendor invoice or a payroll change, marked urgent and confidential
- Money movesThe transfer is authorized inside normal process, so no alarm fires
- A second channel catches itA callback to a known number is what stops this, not a spam filter
That pattern is business email compromise, and it is the costliest crime the FBI tracks by dollars lost. The bureau's 2025 Internet Crime Report records 24,768 business email compromise complaints carrying $3,046,598,558 in losses, an average north of $120,000 per reported case. For an organization running a $2 million annual budget, one successful redirect is a program.
Ransomware is the threat that gets the board's attention and it is not usually the one that arrives. Where it does, the damage in this sector is less about the ransom than about the calendar: a locked case management system stops service delivery, and a locked donor database three weeks before the year-end appeal costs a fundraising season that cannot be run again.
The quieter one is account reuse. Volunteers, seasonal staff and board members accumulate logins that nobody offboards, often to the same shared address, and a password reused from a breached consumer site turns into credential stuffing against the CRM.
Third Party and Fundraising Platform Risk for Nonprofits
The largest single event in the sector's security history was not an attack on a nonprofit. It was an attack on the company thousands of them rented their donor database from.
In 2020, an intruder reached the network of Blackbaud, which sells fundraising and administrative software to charities. In October 2023, 49 states and the District of Columbia settled with the company for $49.5 million. The attorneys general recorded that more than 13,000 Blackbaud customers were affected, that those customers included charities, higher education institutions, K-12 schools, health care organizations, religious organizations and cultural organizations, and that the exposed data covered contact and demographic information, Social Security numbers, driver's license numbers, financial information, employment and wealth information, donation history and protected health information. The alleged violations were of state consumer protection laws, breach notification laws and HIPAA.
The Federal Trade Commission reached the company separately. Its February 2024 order states that the breach went undetected for three months, which allowed the intruder to remove large quantities of unencrypted sensitive consumer data including Social Security and bank account numbers. When the FTC finalized the order in May 2024 it added that the company then delayed notifying its customers for nearly two months. The remedy is the part worth reading twice: the order requires the company to delete personal data it no longer needs and to publish a retention schedule saying why it keeps what it keeps.
The National Council of Nonprofits, the sector's own trade body, puts the same point first in its guidance on cybersecurity for nonprofits: start by taking inventory of every piece of data you collect and where it is stored, ask whether you need it, and satisfy yourself about the security practices of every outsourced bookkeeper, IT consultant, payroll service, cloud provider and donation processor before they hold anything.
What Nonprofit Cyber Security Costs on a Real Budget
This is where most guidance for the sector stops being useful, because the honest first answer is that the highest-value controls cost time rather than money.
Budget in three tiers and do them in order.
The first tier is free or nearly free, and it removes most of the realistic risk: multi-factor authentication on email and the donor database, a written rule that no payment or bank detail change happens without a callback to a known number, patching, offline backups, and deleting the data you stopped needing years ago. CISA publishes a catalog of free cybersecurity services and tools and maintains regional directories of volunteer programs that work with under-resourced organizations at no charge.
The second tier is a small recurring spend: a password manager for everyone including volunteers, managed device encryption, a hosted donation page rather than a self-built one, and a phishing-resistant second factor for the two or three accounts that can move money. Most organizations under fifty staff are looking at low four figures a year.
The third tier is where a firm starts earning its fee: someone watching the systems outside office hours, a tested response plan, and an assessment that a funder or an insurer will accept. It is also where cyber insurance enters, and where the application form starts asking questions that the first tier is the answer to.
How to Secure a Nonprofit Organization
In order, cheapest and most effective first.
When to Hire a Cyber Security Firm for a Nonprofit
Hire when one of three things is true: nobody is watching the systems outside office hours, a funder or an insurer has asked a security question you cannot answer in writing, or something is happening right now. Before those, the money goes further on the eight items above.
What to ask for specifically in this sector: experience with fundraising CRM platforms rather than only corporate networks, a data retention review as part of the engagement, and a response retainer that covers multi-state breach notification rather than technical containment alone. Managed detection and response is the service that covers the overnight gap without hiring a team, and it is the one most likely to be sized wrong for an organization this size, so get the price against your actual endpoint count.
Key takeaways
- Nonprofits are generally outside the CCPA and inside every state breach notification law, so they carry the incident cost without the compliance scaffolding.
- The BLS counts over 300,000 nonprofit establishments and 12.8 million jobs, 9.9 percent of private-sector employment, in 2022.
- Education and health services accounted for 65.0 percent of nonprofit workers in 2022, so most of the sector's staff already sit under HIPAA or a school rule.
- A public Form 990 hands an attacker your officers, revenue and programs, which is why payment redirect works so well here.
- The FBI logged 24,768 business email compromise complaints and $3,046,598,558 in losses in 2025.
- The state office that receives your breach notice usually also holds your charitable solicitation registration.
- More than 13,000 nonprofits were caught by one fundraising software breach, settled with 49 states and DC for $49.5 million.
- The FTC's remedy in that case was deleting unnecessary data and publishing a retention schedule, which is a control any charity can copy for free.
- CISA treats civil society as target-rich and cyber-poor, and publishes free tools and volunteer directories accordingly.
Common questions
Why do hackers target nonprofits?
Because the data is good and the defenses are usually thinner than at a company of the same revenue. A charity holds current contact details for people who demonstrably give money away, payment histories, and often beneficiary records that are sensitive in their own right. It also publishes its officers and finances in an annual filing anyone can download, which makes the reconnaissance stage of a fraud almost free.
Do nonprofits have to comply with data privacy laws?
Partly. Consumer privacy statutes such as the CCPA are written for for-profit businesses and generally do not reach nonprofits. Breach notification laws are written differently and cover any organization holding a resident's personal information, so they apply in full. Beyond that, obligations attach to what an organization does: HIPAA if it provides care, FERPA if it runs a school, PCI DSS by contract if it takes cards, GDPR if it solicits in the European Union.
What is the biggest cyber security threat to a nonprofit?
By financial loss, business email compromise, meaning a fraudulent request to move money that arrives inside a normal-looking email. By breadth, third-party compromise, because a single fundraising or CRM vendor holds the donor files of thousands of organizations at once and one intrusion puts all of them into notification.
How much should a nonprofit spend on cyber security?
Less than most vendors suggest, at first. The controls that remove the largest share of realistic risk are configuration and policy rather than purchases: multi-factor authentication, a payment verification rule, patching, backups and deleting old data. Recurring spend starts with a password manager and device encryption, typically low four figures a year under fifty staff. Monitoring and a response retainer are the step that costs real money, and they are worth buying when nobody is watching overnight.
Are nonprofits required to report a data breach?
Yes, under state law, and the specifics vary by state. California, for example, requires any person or business that must notify more than 500 California residents of a single breach to send that notice to the Attorney General. An organization with supporters across the country can be operating under dozens of these at once, each with its own deadline and its own definition of covered information.
Does a nonprofit need cyber insurance?
Often, but not before the basics. Policies commonly cover notification costs, forensics and legal support, which are the expenses that actually break a small charity's year. What they do not do is substitute for controls: insurers ask on the application whether multi-factor authentication is in place and whether backups are tested, and a gap between the answer and the reality is where claims get argued.
What is the best free cyber security help for nonprofits?
CISA publishes a catalog of free cybersecurity services and tools and maintains regional directories of volunteer programs that work with under-resourced organizations. It also co-published guidance for civil society organizations with the FBI and international partners in May 2024. None of it costs anything, and it is written for organizations without a security team.
How do nonprofits protect donor data?
Start by knowing where it is, because in most organizations the complete record lives with a vendor rather than in-house. Then reduce it: delete supporters you have not contacted in years and fields you never use. Then restrict it: not everyone needs export rights on the whole database. Then protect the way in, which is almost always an email account, with a second factor.
Should a small nonprofit worry about ransomware?
Worry proportionately. Ransomware is less common against small charities than phishing or payment fraud, and the damage when it lands is usually operational rather than an extortion payment: a locked case management system stops service, and a locked donor database before a year-end appeal costs a fundraising season. Tested offline backups are the control, and they are cheap.
Who regulates nonprofit cyber security in the United States?
Nobody, as a dedicated function. There is no sector security regulator equivalent to the HHS Office for Civil Rights in health care. In practice, oversight comes from state attorneys general, who enforce breach notification and consumer protection law and who also supervise charitable solicitation, plus whichever federal rule an organization's activities trigger, plus its own funders through grant agreements.
Does the IRS require nonprofits to have a cyber security policy?
Not a security policy as such. Form 990 Part VI asks whether the organization has a document retention and destruction policy, alongside its conflict of interest and whistleblower questions. That is a governance disclosure rather than a security mandate, but it is the closest thing the sector has to a federal prompt to decide how long data is kept, and shorter retention is the cheapest breach control available.
On this page
- Why Cyber Security for Nonprofits Is Different
- What Data Nonprofits Hold and Why Attackers Want It
- What Regulations Apply to Nonprofit Cyber Security
- How a Nonprofit Data Breach Gets Reported
- The Cyber Attacks That Actually Hit Nonprofits
- Third Party and Fundraising Platform Risk for Nonprofits
- What Nonprofit Cyber Security Costs on a Real Budget
- How to Secure a Nonprofit Organization
- When to Hire a Cyber Security Firm for a Nonprofit
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.