Non-profit organization data breaches expose donor financial information, employee and volunteer personal records, and sometimes sensitive data about the individuals a non-profit serves, such as clients of a healthcare, housing, or social services organization. These exposures can lead to identity theft, direct financial fraud, and scams that specifically target donors using stolen names, giving histories, and contact information to impersonate the organization or solicit further payments. Non-profits are frequently under-resourced when it comes to cybersecurity relative to the amount and sensitivity of the data they collect, which can make them attractive targets despite operating on limited budgets. Depending on the organization’s mission, a breach may also expose especially sensitive information about vulnerable populations the non-profit serves, raising additional privacy concerns beyond typical financial data. This page tracks confirmed data breaches at non-profit organizations, including what data was exposed, which companies notified regulators, and what affected individuals can do next to protect themselves.
Alabama Symphonic Association Inc. notified regulators that a data breach exposed Social Security numbers, prompting concerns about identity theft among those affected.
Alabama Symphonic Association Inc. Data Breach Exposes Social Security Numbers Read More »
Recovery Cafe, a Seattle-based recovery support organization, suffered a ransomware attack linked to the group that may have exposed sensitive client and personal information.
Recovery Cafe Data Breach Exposes Client Health and Personal Records Read More »
The Organization for Transformative Works discovered unauthorized access to its Fanlore wiki in August 2026, exposing roughly 145,000 email addresses along with usernames and hashed passwords.
Organization for Transformative Works (OTW) Data Breach Exposes Emails and Passwords Read More »
NFI North, Inc. has notified nearly 50,000 individuals that their personal and health information was compromised after suspicious network activity was discovered in September 2025.
NFI North, Inc. Data Breach Exposes Social Security Numbers and Financial Information Read More »
Maryville Academy notified regulators that a data breach compromised Social Security numbers, prompting concerns about identity theft among those connected to the organization.
Maryville Academy Data Breach Exposes Social Security Numbers Read More »
Museum Associates, doing business as the Los Angeles County Museum of Art (LACMA), has notified individuals that an unauthorized third party accessed its network in July 2025, exposing personal information.
Shuttle Meadow County Club, Inc. notified the Vermont Attorney General of a data breach involving Social Security numbers, raising identity theft concerns for those affected.
Shuttle Meadow County Club, Inc. Data Breach Exposes Social Security Numbers Read More »
Homeless Prevention Center notified the Vermont Attorney General of a data breach involving Social Security numbers, financial account codes, and credit and debit account information.
Golden Opportunities And Local Support, LLC has notified regulators of a data breach that may have exposed sensitive personal information belonging to clients or employees.
Golden Opportunities And Local Support, LLC Data Breach Exposes Personal Information Read More »
CareerSource Palm Beach County, a Florida workforce development nonprofit, confirmed a ransomware attack in which a threat actor group claimed to have accessed personal and employment records.
CareerSource Palm Beach County Data Breach Exposes Personal and Employment Records Read More »