Why would anyone target a nonprofit?
Why do nonprofits get targeted? Well, that’s easy — cyberattackers target nonprofits for the same reason they target businesses, which is money. Microsoft’s 2025 Digital Defense Report found that extortion and ransomware drove more than half of cyberattacks with a known motive. A nonprofit stores card payments from donors and personal records that can be sold or held for ransom. And make no mistake, being small is no protection. Much of the criminal activity online is automated, and phishing messages or other malicious files can be dispatched to thousands of inboxes with one click, so an organization’s size has no bearing on which are at risk.
The sector’s own figures are stark. When the CyberPeace Institute surveyed 27 Geneva-based NGOs in 2023, 41% had suffered a cyberattack in the previous three years, and 56% had no budget set aside for cybersecurity.
Money is the most common motive, but not the only one. When a nonprofit works with journalists and activists, the target may also be information, particularly information that exposes its contacts, partners, or supporters.
Nonprofits, NGOs, and independent newsrooms use digital platforms and tools like any other organization, so they have to take cybersecurity just as seriously. They store information attackers want, yet they usually have no dedicated security team or budget. For them, cyber hygiene is square one — and it happens to be free.
The first stage of cybersecurity — hygiene
Hygiene appropriately describes the first stage of cybersecurity. If you’re trying to protect yourself against getting sick, handwashing costs nothing, and it’s effective against common illnesses when performed regularly. The digital equivalent is a short set of habits that helps keep strangers with ill intentions out of an organization’s accounts and files.
See the internet for what it is
The internet is a public place. Most people on the internet mean no harm, but that doesn’t mean it isn’t dangerous. Cyberattackers roam the web setting traps and coordinating attacks every day. They use phishing as a common tactic. It involves a bad actor posing as a party you trust to encourage you to hand over or reveal sensitive data. For example, you may receive an email from what looks like a familiar sender, say your director, written closely enough in their style that you don’t question it, asking (but typically urging) you to open an attachment or send over sensitive information. However, if it’s an attacker posing as the director and you follow the instructions, you’ve fallen into a common trap.
Knowing the traps exist is what denies attackers payout. If you suspect a phishing attempt, your best first response is to pause. Before you click a link or open an attachment, read the sender’s full address and look for signs of fabrication. If you still think the message may be forged, use another channel to check with the sender. Be most suspicious when a message sounds urgent — rushing you is a technique that attackers frequently use to bypass a person’s sense of caution or usual decision-making process.
Secure your accounts and devices
Many account break-ins start with a password that was guessed or stolen in another company’s data breach. Attackers can then try that same password on other accounts associated with you. If you reuse passwords, one compromised account can pave the way for bad actors to get into others. To keep that from happening, give every account its own password and make each one at least 12 characters long.
Do also add multi-factor authentication (MFA) wherever an account offers it. MFA is a security method that asks for a second form of proof (like a code from an app on your phone) every time you try to log in to your account.
Apply the same principle to your devices and set every laptop and phone you use to lock after a few minutes and to require a PIN or fingerprint to open.
Be just as careful with what you publish and post online. Personal details posted on social media can give an attacker the material to create a convincing message.
Keep doing the boring stuff
Digital hygiene only works when you keep at it. Four habits to build:
- Install updates when they become available. Most updates fix security flaws that attackers already know about and know how to exploit. Putting updates off creates unnecessary risk.
- Back up important files. Keep one copy offline. If a cyberattack locks or wipes the files on your computers, you’ll still have a clean copy of your files.
- Review who has access to your files. Every few months, check the permissions on your shared folders and make sure only the right people are granted access.
- Close unused accounts. Old accounts may no longer serve a purpose, but they can still become a way into the accounts and files you do use if someone takes them over, which is a security risk.
The second stage of cybersecurity — tools
Using tools often costs money, but some of the most important security tasks can be done for free. You can check a suspicious link, scan an attachment, create a strong password, or encrypt sensitive files using free tools from NordVPN and other established digital security providers.
Check a suspicious link with NordVPN’s link-checking tool
If you’re not confident a link is legitimate, don’t click it — paste it into NordVPN’s Link Checker. The tool matches the address against security databases of known scam and malware sites and reads the page for signs of forgery. It will let you know if it’s safe. Link Checker also uses NordVPN’s machine learning model, which was created to identify zero-day phishing sites — new scam pages that haven’t yet been added into security databases.
Scan an attachment with File Checker
If you receive a document or image you have doubts about, don’t open it — scan it with NordVPN’s File Checker first. The tool checks the file for known malware, which can hide inside seemingly ordinary attachments. That includes malware used to spread ransomware, which can lock an organization’s files and send a demand of payment to release them.
You don’t need to log in to use File Checker. Just download the file without opening it, upload it to File Checker, and the tool will tell you if it contains known malware. Keep in mind that, like any malware scanner, File Checker may not recognize a new threat that hasn’t been identified before.
Create strong passwords with the NordPass generator
For every account, use a strong password that you don’t use anywhere else. The NordPass password generator can create one for you. It generates long, random passwords that are much harder to guess than passwords you might create yourself. That lack of a predictable pattern makes a password more resistant to hacking because password-cracking programs can work through dictionary words, common phrases, and predictable substitutions.
For existing passwords, the NordPass password strength checker can tell you how strong they are and whether you should replace them.
Find leaked logins with Data Breach Scanner
A company you have an account with may not alert you right away after suffering a data breach, so a password tied to that account could already be circulating online or on the dark web without you knowing. NordPass’ Data Breach Scanner is a free tool you can use to check whether your work email addresses have appeared in leaked databases.
If the scanner finds your details in a breach, change the password for the affected account immediately. If you reused that password on other accounts, replace it on those accounts too, and turn on MFA wherever it’s available.
Turn on MFA with an authenticator app
MFA adds another check after your password, and an authenticator app can provide that second form of proof. Apps such as Google Authenticator generate one-time codes that you enter when logging in. They’re safer than codes sent by text message because text messages can be intercepted or redirected to another SIM card.
Start with the email account you use to register for other services. If someone gains access to your inbox, they may be able to reset the passwords for other accounts linked to that email address.
Encrypt sensitive files with NordLocker
Sensitive files such as donor lists, beneficiary records, or source notes shouldn’t be left readable if your device or storage account is compromised. NordLocker encrypts those files, scrambling their contents so that a bad actor without access can’t read them.
The free plan gives you 3 GB of encrypted cloud storage. That may not be enough for your entire archive, but you can use it for the files that would cause the most harm if they leaked.
Keep conversations private with Signal
For conversations that may contain sensitive information, use Signal instead of ordinary text messages. Signal is a free messaging app that encrypts messages and calls end to end, meaning only the people in the conversation can read or hear them.
Use it for conversations with sources, field staff, or anyone else you exchange sensitive information with. You can also turn on disappearing messages to automatically remove messages after a set amount of time, leaving less conversation history on your phone if it’s lost, stolen, or seized.
Encrypt your internet connection with a VPN
For more privacy and security online, use a VPN to encrypt your internet traffic. A VPN creates an encrypted connection between your device and a VPN server, preventing your internet service provider (ISP) and others on the network from seeing the contents of the traffic traveling through that connection. A VPN is particularly useful when you’re working from hotels, cafés, airports, shared workspaces, or other networks you don’t control.
NordVPN is a paid service, but eligible nonprofits and journalists can apply for free or discounted accounts through the NordVPN nonprofit program. Once connected, you can use NordVPN’s What is my IP tool to check that the VPN has changed the IP address visible to websites.
Where can a small team get more help?
You don’t have to figure your cybersecurity strategy out on your own. If your team needs more guidance, NordVPN’s Cybersecurity for Changemakers course is free for nonprofits and covers topics such as phishing, incident response, and protecting donor data in short videos.
And if you’re dealing with a cyberattack or another urgent digital security problem, you can turn to Access Now’s Digital Security Helpline for free emergency support for civil society groups and journalists.
References
Microsoft. Extortion and ransomware drive over half of cyberattacks opens in a new tab.
Protect·ⁿᵍᵒ (former CyberPeace Institute). CyberPeace Analytical Report opens in a new tab.
NordPass. Try NordPass random password generator opens in a new tab.
NordPass. How secure is my password? opens in a new tab
NordPass. Have I been hacked? opens in a new tab
NordLocker. Make sure your data stays private opens in a new tab.
Online security starts with a click.
Stay safe with the world’s leading VPN
