Non-profit organization data breaches expose donor financial information, employee and volunteer personal records, and sometimes sensitive data about the individuals a non-profit serves, such as clients of a healthcare, housing, or social services organization. These exposures can lead to identity theft, direct financial fraud, and scams that specifically target donors using stolen names, giving histories, and contact information to impersonate the organization or solicit further payments. Non-profits are frequently under-resourced when it comes to cybersecurity relative to the amount and sensitivity of the data they collect, which can make them attractive targets despite operating on limited budgets. Depending on the organization’s mission, a breach may also expose especially sensitive information about vulnerable populations the non-profit serves, raising additional privacy concerns beyond typical financial data. This page tracks confirmed data breaches at non-profit organizations, including what data was exposed, which companies notified regulators, and what affected individuals can do next to protect themselves.
The Society of Tribologists and Lubrication Engineers notified individuals that a data incident may have exposed their names and payment card information.
The Legal Aid Society, a New York nonprofit legal services provider, has notified regulators that client personal information may have been exposed after a security incident discovered in September 2026.
The Legal Aid Society Data Breach Exposes Client Personal Information Read More »
The Hudson River Museum of Westchester, Inc. notified regulators that a data breach exposed Social Security numbers, prompting concerns about identity theft among those affected.
The Hudson River Museum of Westchester, Inc. Data Breach Exposes Social Security Numbers Read More »
Penquis CAP notified the Vermont Attorney General that a data breach exposed Social Security numbers, raising identity theft risks for affected individuals.
Penquis CAP Data Breach Exposes Social Security Numbers Read More »
A paper document holding client names, Social Security numbers, addresses and birth dates was stolen from a Community Teamwork office in Lowell, Massachusetts, prompting the nonprofit to notify affected individuals and offer identity protection services.
Families United Network, a Pennsylvania child welfare nonprofit, says an intruder accessed and downloaded an employee email account containing names, Social Security numbers, medical records and other sensitive client data.
The Woodlands Art Council notified the Vermont Attorney General of a data breach involving financial account codes and credit or debit card information. Here is what affected individuals should know and do next.
A ransomware group has claimed responsibility for a cyberattack on Step By Step, Inc., a Pennsylvania nonprofit serving individuals with disabilities, raising concerns about exposed personal and health data.
Step By Step, Inc. Data Breach Exposes Sensitive Personal and Health Information Read More »
Impact Melanoma Inc. notified regulators that unauthorized access to employee email accounts may have exposed a person’s full name and Social Security number, months after the intrusion was first detected.
Impact Melanoma Inc. Data Breach Exposes Names and Social Security Numbers Read More »
An unauthorized party accessed files containing personal information belonging to clients of Goodwill Industries of Greater Grand Rapids, according to a notice filed with Massachusetts regulators.