Cybersecurity – not just for our corporate counterparts

Cybersecurity is on the minds of Australians given the recent breaches of AHM, Medibank, and Optus data. In our sector, Blackbaud paid a ransom and faces lawsuits filed by multiple customers due to a data breach in May 2020.
According to a recent article published in UK Fundraising, 1 in 8 charities have been affected by cybercrime in the past 12 months.
How secure is your organisation? A UK Charity Commission survey suggested the most common types of attacks were phishing and impersonation, both of which can put personal data at risk.
The survey conducted by IFF Research in October 2022, showed 2,330 charities in England and Wales underreport incidents with only 34% of affected charities reporting breaches.
Australian Charities and Not-for-Profits Commission (ACNC) White Paper
Every organisation has a duty to ensure cybersecurity. These and other actions can help ensure your organisation is as secure as possible. The Australian Charities and Not-for-Profits Commission (ACNC) published a white paper focused on cybersecurity, which suggests real potential issues for each of our organisations if we do not mitigate risk. Those issues include:
- loss of crucial information
- disruption to services
- unauthorised changes to your charity’s information and systems
- expensive costs to restore data and services
- costs of notification and investigation (including legal costs)
- costs arising from the attack itself (for example, extortion or ransomware)
- regulatory action and penalties
- loss of trust and reputation
According to the Identify Theft Resource Center, the information exposed in the Blackbaud breach included Social Security numbers, driver’s license numbers, passport numbers, personal health information (PHI), financial information, credit card information, telephone numbers, email addresses, dates of birth, mailing addresses, phone numbers, student I.D. numbers, biographical information, donation dates, donation amounts and other donor profile information. Blackbaud is calling this a security incident.
The Charities Commission in the UK has suggested a stronger use of two-factor authentication, which is something most CRM suppliers are requiring of their customers. Further, the Commission suggests:
- updating training and policies
- backing up data using cloud services
- ensuring the latest version of antivirus and other software is used
The ACNC recommends four steps to prevent cybersecurity:
- identify and assess the risks
- prevent incidents and mitigate risks
- engage people in the charity, and even third parties, to help manage risks
- take action when concerns, suspicion or complaints arise





It is the easiest task to do, yet it is often times overlooked in our day-to-day responsibilities. In the rush to get stuff done, including finding new donors, asking for that next big gift, we are overlooking the most important task. I am talking about saying thank you to donors, volunteers, and staff.
Think about your non-profit organisation’s Constituent Relationship Management (CRM) solution for a moment. Is it configured and designed so you are you able to fully record a constituent and their contact details? Tick. Are you able to record a donation and associated details? Tick. Does it end there? Issue. A CRM needs to be relational in focus because a CRM is not simply a transactional database.
Searching for a new CRM is a
Your payment gateway. Cost per transaction? Sure, it is important.
Searching for a new constituent relationship management (CRM) solution is no easy task. The process, as I outlined in a recent 
