From human rights groups serving at-risk communities to educational organizations working with minors, nonprofits often handle sensitive information. Your organization likely deals with payment information, home addresses, and other private data each day, all of which can leave you and your constituents vulnerable to data leaks in the event of a cyberattack.
The goal of this guide is to provide a high-level overview of the risks nonprofits face online, along with some practical things you can do to safeguard your data, protect your constituents, and keep your website working for your community, even when it’s being pummeled by bots.
What cybersecurity risks do nonprofits face?
Nonprofits face the same online threats as any business with a website, but often with a fraction of the technical resources to fight back. Risks include:
Site outages from traffic surges
The modern internet comes with unpredictable traffic surges, whether it’s an aggressive LLM crawler requesting so many pages that it locks everyone else out, a malicious script conducting a brute-force attempt to guess a password on your login page, or a Distributed Denial of Service (DDoS) attack, the result is the same: your site becomes unavailable for the humans who need to use it, for hours or days at a time. If your site randomly goes down for a few hours at a time, then comes back up on its own, this is the most likely culprit.
Stolen credit card testing (carding)
If your payment form doesn’t have any form of rate limiting or bot protection, criminals can use it to test thousands of stolen credit cards by making a stream of small donation attempts. This mostly results in rejected charges, but a few will go through, allowing those criminals to use the stolen cards to commit more crimes.
You’ll have to go through the hassle of refunding the fraudulent donations, and credit card providers have been known to abruptly cancel services for nonprofits whose sites are used maliciously.
Email spoofing and phishing attacks
An attacker doesn’t even need access to your server to send spoofed emails with fake return addresses, asking you to pay a bill or send bank information, or share a malicious link to steal credentials.
Content injection or vandalism
Malicious scripts can flood user-generated content fields like comments or contact forms with spam content, or exploit a security vulnerability to inject spam (links to gambling sites, for example) or other malicious text into your web content. This may not crash your site completely, but you also don’t want your site to be flogging bogus nutritional supplements.
Server takeover
Worse than content injection, sometimes a hacker, script, or agent exploits a vulnerability to acquire code execution privileges on your server itself. In situations like that, the bad actor can do anything they want.
These attackers could:
- Use your site to attack and infect other websites.
- Steal any data in your database.
- Add malicious code to steal form inputs—including credit card numbers.
- Alter your website itself so it does something completely different. We’ve even seen situations where the hacker kept the organization’s website online for visitors from the US but showed a different site to visitors from other regions, so the organization didn’t know the site was hacked.
In an extreme case, the hacker could execute a ransomware attack and lock you out of your own data. Oh, and they can also cover their tracks, so you can never be sure exactly what they did while they were in there.
Server hosting account takeover
Even worse than a server takeover is when a bad actor gets access to your root credentials for Amazon AWS or another virtual server provider. When they have access to your hosting account, they can not only get into all of your servers, but they can use scripts to create an astonishing number of servers in a very short amount of time, and use them for whatever they want, until they max out your account and run up such a huge bill that the server provider shuts them down.
Domain name takeover
The worst of these cybersecurity risks is a domain name takeover, in which a malicious attacker gains control of your domain name. With control over DNS resolution for your domain, an attacker could hijack any URL or email address at your domain and send it anywhere else, and if they’ve got full access to your account, they can likely lock you out, meaning you’d need to go through a (usually lengthy) process with your DNS host to prove you’re the rightful owner.
A visible hijacking isn’t even the worst-case scenario; they can issue their own certificates to make malicious pages look legitimate, and they can disable your email authentication and invisibly route emails through a server they control to harvest email content, potentially gaining access to other accounts. (Spoiler for our recommendations below: put two-factor authentication on your domain name registrar!)
Why aren’t “AI attacks” on the list above? Because any of the threats above could be conducted by AI agents or facilitated by AI tools. Later on, we’ll discuss our thoughts on AI, but the short version is that AI exacerbates all of these risks, while our security fundamentals and responsibilities remain the same.
If all of this seems overwhelming, unfair, and arcane all at the same time, you’re not wrong! Fortunately, there are things you can do.
Nonprofit Cybersecurity Fundamentals: Protect Your Digital Assets
With cybersecurity, it’s essential to find a good place to start and focus on ongoing improvements. If you imagine your digital assets as a house, you don’t want to spend a bunch of time and money hardening an upstairs window when your front door is standing open. Here are some foundational nonprofit cybersecurity practices that will help you close off your ground-floor windows and doors:
Use two-factor authentication (2FA)
Usernames and passwords can be guessed for key accounts like domain registration, server hosting, and website logins, and 2FA is the answer. 2FA is the term for techniques in which logging in (“authenticating”) requires a temporary code. Because it’s temporary, it’s much harder for a malicious actor to guess.
Implementing 2FA is one of the highest-leverage things you can do to protect your online presence. 2FA can be inconvenient, sure, but it’s worth putting up with, because it makes your organization much harder to phish and protects you against weak passwords. Also, because 2FA is often delivered via email, SMS, or a phone app, make sure you keep a record of who has access to the 2FA authenticator, and ensure it’s an asset that belongs to your organization and stays even if the person who sets it up moves on.
Use 2FA for all organizational email accounts
Yes, this is another section about 2FA; it really is that important. If a hacker gains access to an organizational email account, either through phishing or a weak or repeated password, they can use many platforms’ password reset features to access and alter every account that email address can log in to (including any accounts that rely on email-based 2FA for security!). Email two-factor authentication is a must for every nonprofit, and it’s usually free.
Train staff to recognize phishing attempts (but don’t rely on training alone)
It is difficult to train staff to prevent phishing, with attackers always coming up with new methods, of course, but one simple practice is to regularly share the details of incoming phishing attacks with the whole company, so everyone learns to recognize them.
If you’re a company leader, make it safe and routine for people to contact you via phone or text to double-check if they ever receive a weird email from you asking them to do something urgently (which is a common impersonation pattern) Of course, training can never be fool-proof, and new phishing attempts are developed all the time, so be sure to supplement training with other defenses, like using passkeys.
Deploy an organization-wide password manager, and use passkeys when possible
Storing and sharing passwords securely is important, and an organization-wide password manager (such as Bitwarden) is an important tool for doing that, rather than relying on individual staff to track their own passwords or use their own password manager.
Additionally, once you have an organization-wide password manager, you can create and share passkeys internally, which provides superior phishing prevention while still allowing access to be delegated internally. A good password manager can also provide a built-in TOTP (Time-based One-Time Password) generator like an authenticator on your phone, so it can serve as a centralized 2FA authenticator for accounts across your organization.
Set up DMARC, and tell it to reject spoofed messages
DMARC (Domain-based Message Authentication, Reporting, and Conformance) can be configured to reject emails with a spoofed sender. This is something you set up with your DNS hosting provider, and you may want some help from your IT department if you have one) or from a nonprofit cybersecurity expert if you don’t.
Minimize sensitive data
Hackers can’t steal data that’s not there. Avoid storing sensitive information about your clients, donors, or staff, unless it’s absolutely essential to your work.
Use good baseline server security practices
If you maintain your own server, follow server security best practices like encrypting your data at rest, making sure you have a valid certificate and that your website is forcing HTTPS, and requiring SSH to access the server, etc. Whoever sets up your server, whether it’s a specialty host or a nonprofit managed hosting provider, should do all that for you.
Keep your CMS and other software up to date
Like any complex software, your CMS (whether it’s WordPress, Drupal, Backdrop, or a JavaScript-based headless one) needs regular security updates. Most of them aren’t urgent, but a few are, and with the advent of AI coding tools, the window between the disclosure of a vulnerability and an exploit in the wild has narrowed dramatically.
You’ll either want to enable automatic updates so your site updates itself—which also means you risk bugs on your live site if there’s an issue with the update—or be vigilant about reviewing every update and applying urgent fixes promptly.
Pick a hosting provider that handles automatic CMS updates without letting the website write to itself
It’s nice when you can click a button and install a plugin or apply updates. That’s the way most hosts work, to make it easy for non-technical users to update the site. The problem with that setup, however, is that allowing WordPress to rewrite itself like that means malicious scripts or hackers can rewrite the site, too, so any WordPress vulnerability could lead to a full takeover of the site. This would be true of any CMS, but WordPress is by far the most common, so it has far more attempted exploits.
It’s more secure to require a different user, who can only access the site via SSH, to apply updates, install or change code, etc. The additional layer of security means end users can’t install plugins on their own anymore, but it shuts down many severe security vulnerabilities at the source.
Have daily backups, and test them regularly
Make sure you’ve got a full backup of your website code, database, and uploaded files at least daily, and store it somewhere separate from your web server so you don’t lose it if the whole server fails. Also, be sure you test your backups, preferably with both an automated check and a periodic manual check. The moment you realize you need your backup is not the moment you want to find out whether they’ve really been working!
Use caching, firewall services (like Cloudflare), or other security software (like Crowdsec) to protect your site from bots
Bots are tricky opponents who are constantly changing their tactics. You can ask your host’s support, but if their response is just to reflexively up-sell you on a more expensive plan, seek a second opinion.
If you’re comfortable reading server logs, you can sometimes try some spot-mitigation yourself, blocking problematic IP addresses or certain sections of your site that bots like to frequent (they love search pages), but often this is something you’ll want outside help with.
Keep good documentation, and make sure your leadership knows where it is
It’s hard to troubleshoot any of this if you’re not even sure where your website, your domain, or your email is hosted. Keep centralized documentation for all your key accounts, and make sure it’s carefully shared with a few key staff members, so that if one person loses access to their account, it can’t disappear. Log your accounts, but keep the passwords in a secure password manager somewhere else—again, something multiple trusted people can access.
Don’t forget to keep a record of all 2FA devices (preferably in your central password manager) that you’ve already added to all your key accounts!
How Does Artificial Intelligence Impact Cybersecurity for Nonprofits?
As we mentioned earlier, AI is currently making all of the above threat vectors worse and all of the above mitigation strategies more important. Think of AI-enabled or AI-conducted attacks as the same zombies as before, but there are more of them, and they’re faster. AI allows for more convincing, higher-volume phishing attempts. It accelerates the search for security vulnerabilities and, more critically, greatly increases the speed at which exploits are released into the wild once a vulnerability is discovered. AI tools make writing code faster in many situations, so they make it faster to develop tools to exploit a breach once it’s been achieved.
Of course, there are security advances that utilize AI as well, and your support team may use AI tools to make their response faster and more comprehensive. Cloudflare offers AI-enhanced firewall services, Crowdsec uses AI to evaluate threats and automate ways of blocking them, and your friendly neighborhood web support team may well use an LLM-powered tool to comb through your logs or help with other diagnostics or remediation.
For now, the presence of AI tools on both sides doesn’t change your fundamental responsibilities as a nonprofit; it just makes it more important to maintain a consistent, comprehensive, ongoing approach to keeping your digital assets secure.