Loading story…
Nonprofit organizations are facing sustained cyber risk, but the scale of the problem remains difficult to quantify because incidents are often underreported and the sector lacks consistent breach-reporting requirements. Reporting cited in Dark Reading says nonprofits are increasingly targeted because they hold sensitive donor, beneficiary, and operational data while often operating with weaker security postures, limited budgets, and too few skilled security staff. Industry data referenced in the coverage indicates growth in advanced email attacks and phishing against nonprofits, while identity-focused telemetry places the sector among the most targeted industries.
Security practitioners interviewed in the coverage said the lack of dependable incident data obscures the true threat level and makes it harder for nonprofits to justify funding, tools, and outside support. They argue that stronger reporting, better access to security technology, and more training are needed, but also stress that many nonprofits may struggle to implement recommended defenses without broader assistance from the cybersecurity industry and other stakeholders. The reporting frames nonprofits as part of essential community infrastructure whose cyber exposure has outpaced the resources available to defend them.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
In Dark Reading coverage published on March 13, 2026, experts from Sightline Security and other security leaders said nonprofits are underprotected, incidents are underreported, and the sector needs more practical, mission-aware cybersecurity assistance. They argued nonprofits should be treated more like critical infrastructure and supported with training, time, and tailored security guidance.
Okta's 'Nonprofits At Work 2025' report ranked nonprofits as the second-most targeted industry in Okta's customer ecosystem. The finding reinforced claims that nonprofits are a major target for cyber threat actors.
The same Abnormal Security data showed phishing attacks against nonprofits rose 50% in March 2025 versus the prior year. This was cited as a concrete indicator of escalating targeting of the sector.
Abnormal Security data cited in the reporting found a 35% increase in advanced email attacks targeting nonprofit organizations in March 2025 compared with the previous year. The increase was presented as evidence that nonprofits are facing growing cyber pressure.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple commentaries and vendor research warn that **operational overload**—especially high alert volumes and false positives—can cause security teams to miss real intrusions. SC Media highlights how SOCs often add more tools but fail to tune and prioritize detections, contributing to **alert fatigue**; it cites industry research indicating significant portions of alerts are ignored and that cloud security alerts frequently contain high false-positive rates. The same theme is reinforced in public-sector guidance that links overwhelmed teams and poor alert routing/ownership to increased risk for critical services and sensitive citizen data, using the Target breach as an example of how actionable alerts can be overlooked amid noise. Separately, Rapid7 argues that many successful intrusions are materially enabled by an organization’s **external digital footprint**—data exposed outside the technical perimeter via SaaS, social media, code repositories, third parties, misconfigured cloud assets, and breach-derived credential/PII leakage—improving adversary reconnaissance and targeting. The Hacker News piece focuses on **manual processes** for transferring sensitive data in national security environments as a systemic vulnerability, emphasizing legacy constraints and procurement delays; while adjacent to public-sector risk themes, it is primarily about data-transfer automation rather than alert fatigue or digital footprint reconnaissance.
Jun 29, 2026
Security and privacy leaders are reporting increased pressure to improve **attack surface visibility** and strengthen privacy programs as digital transformation expands exposure across cloud, SaaS, APIs, endpoints, and third parties. A LinkedIn poll cited by *SC Media* ranked attack surface visibility as the top infrastructure security priority (40%), ahead of cloud/hybrid security and identity and access security (25% each), while a separate *SC Media* commentary tied modern privacy risk to the same drivers—rapidly growing environments and increasingly industrialized cybercrime—arguing that breach risk remains a direct threat to business resilience and consumer trust. Multiple reports highlighted how breach activity and downstream abuse continue to shape priorities. *DataBreaches.net* relayed BBC reporting that criminals are buying stolen customer databases (including alleged data from **Kering**) to identify high-value targets and run tailored crypto scams, with one hacker claiming to have used cross-referenced breach data to steal from **Coinbase** users. In healthcare, a Fortified Health Security report cited by *DataBreaches.net* found breach frequency more than doubled in 2025 while exposed patient records decreased, attributing the shift to **ransomware**, **identity compromise**, and **third-party weaknesses**—a pattern emphasizing operational resilience over sheer record counts. Separately, figures reported for the UK’s **North West Ambulance Service NHS Trust** showed nearly 400 breach incidents over three years, with many categorized as confidentiality failures and misdisclosures, and the trust suggesting improved reporting/training may be contributing to higher counts. An *ISACA* study summarized by *Help Net Security* added that privacy teams face budget and staffing strain, and that **AI** use for privacy tasks (e.g., data discovery and monitoring) tends to correlate with program maturity and board support rather than urgency, while consistent *privacy-by-design* adoption remains uneven.
Jun 29, 2026
UK reporting highlighted persistent weaknesses in baseline cyber hygiene and a growing expectation that **phishing and social engineering** will succeed against many organizations. A Vodafone Business-commissioned snapshot cited by Tech Radar/SC Media reported that **63% of UK businesses** feel more exposed to cyberattacks than a year ago, **71% of leaders** think employees are vulnerable to phishing, and staff reuse work passwords across an average of **11 personal accounts**; only **45%** of organizations said all staff had completed basic cyber awareness training. The same coverage noted increasing concern about **AI-enabled scams and deepfakes**, with **70%** reporting greater suspicion of video calls impersonating senior leaders, and pointed to the UK government’s planned *Telecommunications Fraud Charter* as part of broader anti-fraud efforts. Separately, the Bank of England’s 2025 CBEST review (summarized by The Register) found that regulated financial firms and **financial market infrastructures (FMIs)** still commonly fail on fundamentals observed during **13 CBEST assessments and regulator-backed penetration tests**, including **weak access controls**, poor password practices, **misconfigured and inconsistently patched systems**, and gaps in **intrusion detection** and vulnerability management. The report emphasized that firms should be prepared to **handle breaches** rather than relying only on preventive controls, and that weak security culture enables attackers to bypass controls via social engineering; it also warned that inadequate helpdesk identity-verification processes can enable fraudulent credential access, with the NCSC noting such tradecraft aligns with groups like **Scattered Spider**.
Jul 12, 2026