Non-profit organization data breaches expose donor financial information, employee and volunteer personal records, and sometimes sensitive data about the individuals a non-profit serves, such as clients of a healthcare, housing, or social services organization. These exposures can lead to identity theft, direct financial fraud, and scams that specifically target donors using stolen names, giving histories, and contact information to impersonate the organization or solicit further payments. Non-profits are frequently under-resourced when it comes to cybersecurity relative to the amount and sensitivity of the data they collect, which can make them attractive targets despite operating on limited budgets. Depending on the organization’s mission, a breach may also expose especially sensitive information about vulnerable populations the non-profit serves, raising additional privacy concerns beyond typical financial data. This page tracks confirmed data breaches at non-profit organizations, including what data was exposed, which companies notified regulators, and what affected individuals can do next to protect themselves.
Community Based Care Brevard, operating as Family Partnerships of Central Florida, notified the Vermont Attorney General that a data breach exposed Social Security numbers belonging to affected individuals.
Community Based Care Brevard Data Breach Exposes Social Security Numbers Read More »
National Alliance for Direct Support Professionals notified individuals in July 2026 that hackers accessed an email system holding Social Security numbers, driver’s license numbers, and financial account details months earlier.
PAMCAH-UA Local 675 Health and Welfare Fund notified individuals that hackers accessed employee email accounts for over two weeks, potentially exposing names, birth dates, and Social Security numbers.
Neon One, a fundraising software provider for nonprofits, has notified individuals that a cyberattack on a third-party vendor exposed their personal information.
Neon One Data Breach Exposes Donor and Client Personal Information Read More »
The Archdiocese of Indianapolis notified regulators that a December 2024 security incident exposed the personal and financial information of employees, students, parents, and donors.
An employee of the Fresno County Department of Social Services accessed a file holding client names, addresses, phone numbers, and Medi-Cal or IHSS case numbers without authorization, prompting notification letters to affected residents.
AcademyHealth, a Washington, D.C.-based health research nonprofit, notified the Vermont Attorney General that a data breach exposed Social Security numbers, government ID numbers, and financial account details.
AcademyHealth Data Breach Exposes Social Security Numbers and Financial Data Read More »
United States Tennis Association Texas notified 871 individuals that hackers accessed their names and Social Security numbers in a recent data security incident.
United States Tennis Association Texas Data Breach Exposes Social Security Numbers Read More »
Houston Symphony Society disclosed a data breach affecting 1,874 people, with Social Security numbers, driver’s license numbers, financial account details, health insurance information, and birth dates exposed.
Houston Symphony Society Data Breach Exposes Social Security Numbers and Financial Data Read More »
Oak Hill, a Connecticut nonprofit serving people with disabilities, has confirmed that a 2025 network intrusion exposed clients’ Social Security numbers, driver’s license numbers, and medical records.
Oak Hill Data Breach Exposes Social Security Numbers and Medical Information Read More »