Why are charities targeted by cyber criminals?

Charities are increasingly targeted by cyber criminals, not because they are careless, but because of the nature of the work they do.

Many charities:

• Hold personal and sensitive information
• Rely heavily on email and cloud services
• Operate on trust and goodwill
• Have limited time and resources

This combination can make charities attractive targets for cyber attacks such as phishing, ransomware, and fraud.

---

The role of sensitive data

Charities often handle information relating to:

• Beneficiaries and service users
• Donors and supporters
• Staff and volunteers
• Safeguarding and health-related matters

This type of data is valuable to criminals and can be exploited if systems are not properly secured.

---

Trust and social engineering

Cybercriminals frequently use social engineering, exploiting trust rather than technical weaknesses.

Charity staff and volunteers may be targeted with emails or messages that:

• Appear urgent
• Seems to come from trusted contacts
• Reference real events or people

This makes phishing attacks particularly effective in the charity sector.

---

Limited resources do not mean low risk

Smaller charities are sometimes assumed to be “too small to target”. In reality, attackers often see smaller organisations as easier targets.

Even a single compromised email account can lead to:

• Financial loss
• Data breaches
• Service disruption
• Reputational damage

The impact can be significant, regardless of the charity’s size.

---

Reducing charity cyber risk

While no organisation can eliminate risk entirely, charities can significantly reduce charity cyber risk by:

• Using strong passwords and multi-factor authentication
• Keeping systems and software up to date
• Training staff and volunteers to spot scams
• Backing up important data
• Having clear responsibility for IT and cybersecurity

These steps are proportionate, practical, and achievable for most charities.

---

A governance issue, not just a technical one

Cybersecurity is now widely recognised as part of good charity governance.

Trustees do not need to be technical experts, but they do need to ensure that risks are understood, discussed, and managed. Having the right support in place helps charities demonstrate that they are taking reasonable steps.