Non-profit organization data breaches expose donor financial information, employee and volunteer personal records, and sometimes sensitive data about the individuals a non-profit serves, such as clients of a healthcare, housing, or social services organization. These exposures can lead to identity theft, direct financial fraud, and scams that specifically target donors using stolen names, giving histories, and contact information to impersonate the organization or solicit further payments. Non-profits are frequently under-resourced when it comes to cybersecurity relative to the amount and sensitivity of the data they collect, which can make them attractive targets despite operating on limited budgets. Depending on the organization’s mission, a breach may also expose especially sensitive information about vulnerable populations the non-profit serves, raising additional privacy concerns beyond typical financial data. This page tracks confirmed data breaches at non-profit organizations, including what data was exposed, which companies notified regulators, and what affected individuals can do next to protect themselves.
Families United Network, a Pennsylvania child welfare nonprofit, says an intruder accessed and downloaded an employee email account containing names, Social Security numbers, medical records and other sensitive client data.
The Woodlands Art Council notified the Vermont Attorney General of a data breach involving financial account codes and credit or debit card information. Here is what affected individuals should know and do next.
A ransomware group has claimed responsibility for a cyberattack on Step By Step, Inc., a Pennsylvania nonprofit serving individuals with disabilities, raising concerns about exposed personal and health data.
Step By Step, Inc. Data Breach Exposes Sensitive Personal and Health Information Read More »
Impact Melanoma Inc. notified regulators that unauthorized access to employee email accounts may have exposed a person’s full name and Social Security number, months after the intrusion was first detected.
Impact Melanoma Inc. Data Breach Exposes Names and Social Security Numbers Read More »
An unauthorized party accessed files containing personal information belonging to clients of Goodwill Industries of Greater Grand Rapids, according to a notice filed with Massachusetts regulators.
The Association of the Bar of the City of New York notified the Vermont Attorney General of a breach exposing financial account codes and credit or debit account information tied to its members.
Kings United Way notified the California Attorney General of a data breach that may have exposed personal information belonging to individuals connected to the nonprofit.
Kings United Way Data Breach Exposes Personal and Financial Information Read More »
A threat actor group claims to have stolen roughly 181,420 documents from the United Federation of Teachers, including grievance files, disciplinary case records, and member personnel data.
United Federation of Teachers Data Breach Exposes Grievance and Personnel Case Files Read More »
The Lighthouse for the Blind, Inc. notified the Washington State Attorney General of a data breach that exposed personal information belonging to employees or clients.
The Lighthouse for the Blind, Inc. Data Breach Exposes Personal Information Read More »
New Covenant Believers’ Church suffered a ransomware attack claimed by the threat actor group, raising concerns that congregants’ and staff personal information may have been accessed or stolen.
New Covenant Believers’ Church Data Breach Exposes Personal and Financial Information Read More »