Join our Nonprofit Good News-Letter
Cyberthreats just keep getting worse.
When I identified Cyberthreats as Challenge 13 in Managing Your Nonprofit for Resilience, the warning signs were clear. Today, the risks are even greater. Small and mid-sized nonprofits remain especially vulnerable: limited IT staff, outdated systems, tight budgets, and low awareness create a perfect storm. Cybersecurity is no longer an IT chore, it’s a core resilience issue and a direct mission-protection priority. My goal in this post and two others we will publish this week is to be candid about the risks while offering supportive, realistic guidance and helping you see that cybersecurity is mission security, and you can manage it proactively. Here is a brief overview of the current threat landscape, highlighting changes since 2022.
Nonprofits handle sensitive information (donor data, client records, payment details) and provide critical services, yet many assume they’re “too small” to attract hackers. In reality, attackers view them as high-value, low-defense opportunities.
Many nonprofits collect personal and financial data (donor names, emails, credit card numbers, even health or client information) that can be sold or used for fraud. Yet 70% of nonprofits lack a formal cybersecurity policy, and many don’t invest in strong defenses. Hackers know this and view nonprofits as “low-hanging fruit” that often can’t fight back. In short, high-value data + weak security = attractive target.
Smaller nonprofits often lack dedicated IT or cybersecurity personnel. Staff and volunteers wear many hats and may not have specialized training to recognize cyber threats. Without dedicated technical support, missteps are easier and attacks are harder to spot.
Cybercriminals know nonprofits feel urgency to keep services running, making them more likely to pay ransoms or rush decisions.
Hackers often perceive themselves as issues advocates, as well as money-making ventures. With political tensions at fever pitch these days, if your mission doesn’t fit with the Trump Administration’s priorities, you are also a target.
Recognizing this risk is the first step to managing it. My goal isn’t to alarm you; it’s to underscore that awareness is the foundation of protection.
So, has the cyberthreat landscape for nonprofits improved or worsened since late 2022? Unfortunately, in many ways, it’s gotten worse. Cyberattacks are growing in frequency and sophistication, though awareness is slowly rising in response. Let’s break down the current landscape:
Cyber incidents targeting nonprofits have continued to surge. Industry research shows that nonprofits experienced substantially more cyber incidents over the past two years, mirroring global trends. Ransomware attacks on nonprofits have doubled recently. Ransomware and phishing campaigns have scaled dramatically due to automation and AI. The spike in attacks means the odds of your organization encountering an incident are growing each year. Examples abound:
Cybercriminals have refined their tools since 2022. Ransomware gangs now often engage in double extortion—not only encrypting your files but also stealing data and threatening to leak it if you don’t pay. This puts added pressure on organizations to pay ransoms. The average ransom demanded from organizations jumped significantly, by nearly $1 million more in 2024 compared to 2023.
Additionally, attackers leverage automation and even AI to craft more believable phishing lures and to scan for vulnerabilities. We’re seeing more supply-chain attacks (like the MOVEit example) where hacking one software vendor can compromise hundreds of organizations at once. The use of AI can also enable things like deepfake voicemails or personalized scam emails that are harder to detect. In short, the “bad guys” are upping their game with new tricks.
A cyber incident can have devastating consequences for a nonprofit, undermining its mission and viability. Consider the fallout that many organizations face after an attack:
In short, a cyberattack can hit a nonprofit on multiple fronts. It can interrupt your programs, drain money, alienate supporters, and create legal exposure. It’s a nightmare scenario we all hope to avoid.
On a more positive note, there has been increased attention from regulators and the government on cybersecurity, which translates to new requirements and resources that nonprofits need to be aware of in 2025. The trend is certainly negative, but regulators are not standing still:
Has anything improved? Awareness has improved, and more nonprofit-specific resources exist, but the overall risk environment continues to intensify. Some grantmakers now ask about an organization’s cybersecurity posture as part of due diligence, which can motivate nonprofits to put basic protections in place. But overall, the threat environment has intensified. The gap between nonprofit defenses and criminal tactics is still wide in many cases, meaning the risk of a serious incident is higher than ever.
However, there is hope. Even incremental improvements can significantly reduce your risk. I’ll discuss in my next blog: stay tuned.