Natural, aren’t they? Technology is evolving constantly and revolutionizing the way not only corporations but even NGOs operate. With technology you can open your NGO to donors across the globe, collect information from far-flung locations, manage projects online, take in volunteers’ answers in a chat room-style format, and even use artificial intelligence to help take care of back-office chores.
Here’s the catch, however: with this digital transformation also comes a new set of challenges. As NGOs become more dependent on their tech tools, they are also collecting more data, and there’s an inevitable risk that this information can be compromised, stolen, or exploited. What happens when an NGO falls victim to a cybersecurity breach? It goes far beyond a few IT headaches and can impact the very people it is working to help.
Consider this: many NGOs are helping people who find themselves vulnerable or marginalized through no fault of their own—such as through war, natural disaster, or poverty. They may hold personal details, financial data, and even health records about these clients on file. And that can be dangerous if this data becomes compromised.
Think back to the ICRC cyberattack in 2022, which put the spotlight on the importance of cybersecurity in the humanitarian sector when data of over 515,000 people was breached. They were members of the public that had accessed humanitarian aid and included families separated and those in detention.
This event was a firm reminder to all in the NGO sector that protecting your digital information is ultimately protecting your people. How will you protect your digital information?
When a Cyberattack Becomes a Humanitarian Problem
Have you ever been in an Uber or a coffee shop and suddenly start hearing terms like “malware,” “vulnerabilities,” or “ransomware” and wonder if everyone else in the room knows something you don’t? Here’s the thing though: all of those technical terms have real people on the other end. Think of a non-profit working with displaced families. Its database isn’t just a bunch of numbers and characters—it’s the names of people that have moved across borders, information about where they’re living now, and data on family members they’re trying to find.
Now, just think about what would happen if someone who isn’t supposed to get their hands on that database did. All of a sudden, the problem isn’t about computers, is it? The list that was released could be used for harassment, discrimination, or to put the lives of the people on that list in danger.
And in an active conflict zone, the risk becomes all the greater.
So why do we need to rethink cybersecurity in the humanitarian world? Because it’s not just corporate information that’s at risk.
Think about the ICRC’s experience. When they were compromised by a cyberattack, the ICRC was forced to disconnect their compromised systems in order to maintain vital operations until they could remediate. That’s a very real example of how a cyberattack can impact humanitarian work when people are most vulnerable.
The Red Cross Incident: A Warning for the NGO Sector
In January 2022, the ICRC announced that it had identified a sophisticated cyberattack targeting its servers. The systems contained personal information belonging to more than 515,000 particularly vulnerable people.
The data related to people receiving services connected to humanitarian activities, including programs designed to help reconnect families separated by conflict, disaster, and migration.
According to the ICRC, the attackers exploited a known vulnerability and gained access to systems containing sensitive information. The organization had to take steps to contain the attack and protect affected systems.
What made the incident especially concerning was the nature of the information.
These were not simply customer records from a commercial company.
The data involved people who were already facing difficult circumstances.
For an organization like the ICRC, confidentiality is closely connected to its humanitarian mission. People need to feel safe when sharing information with organizations that are helping them.
When that trust is threatened, the impact can extend beyond the immediate technical incident.
The case also demonstrates why NGOs cannot assume that cyberattacks only happen to large technology companies, banks, or governments. Humanitarian organizations can also become targets because they hold valuable and sensitive information.
Why NGOs Are Becoming More Digitally Vulnerable
Don’t you think the digital transformation of the nonprofit sector is exciting? As you step into this new era, you can implement cloud software to help you organize your projects, connect with donors through online channels, gather donations through digital payment solutions, and even rely on AI for report writing and grant applications. However, there’s a flip side to everything…
Imagine this: a tiny NGO running one software for donor management, a different one for accounting, a separate one for emails, another one for project monitoring, and yet another to gather beneficiary details. Does this scenario seem familiar? Perhaps you are also using various organizational accounts across personal computers on a remote-work set-up. Every account, device, app, and connection is part of your NGO’s digital ecosystem.
But what if even one account is not secure? It could become the entry point for the malicious actor into the entire environment. This can be an issue for any size NGO. For example, if you’re a big international NGO, you probably already have a cybersecurity team, a dedicated IT department, and a budget allocated for cybersecurity measures.
Don’t assume for a second hackers won’t target you because of your startup status. They’re always hunting for the hole in the fence. Might be an old software platform, a recycled password, an unsecured account, or even a phishing success—all of which could result in a major security breach. Are you ready?
Employees Are Part of the Security System
Assuming cybersecurity is only the IT team? Sorry, no. But you should know: everyone in your organization has a role to play.
You’ve received an email that’s claiming to be from a donor.
Or you’ve opened a dodgy file as a volunteer. Or you’re a project manager and you’ve emailed a sensitive file to the wrong person. Or you’re using the same password across multiple sites… What’s the worst that could happen?
So what can you do? Acknowledge that these types of incidents pose risks to your security, no matter how advanced your organization’s technology may be. No one in your NGO should be excluded from cybersecurity training. Your NGO can take advantage of basic training to identify phishing emails, strange links, counterfeit login pages, requests, and social engineering.
It Doesn’t Have to Be Hard You just need a sharp eye to spot the telltale signs and a pre-established plan when you feel uneasy. The other biggie? It’s critical to have a culture where you’re comfortable confessing your sins.
If you click on a rogue link, own up to it!
Quickly reporting it can be the difference between a minor detour and a major disaster. Have any questions? Are you ready to be part of the solution?
The Growing Role of Artificial Intelligence
The hype of artificial intelligence is changing the landscape of NGO cybersecurity. Here’s what that means for you. Imagine you work for a nonprofit, and you’re writing a report or looking for a grant opportunity. AI tools may rush in like Caped Crusaders to assist you with content translation or grant research.
Does that sound great?
Here’s the caveat.
AI also presents an important question: What information is okay for you to send to them? Imagine this: you’re drafting a funding proposal filled with sensitive info on your beneficiaries, budgets, or community conditions. If you input this data into an AI tool without understanding how they handle data, you could be exposing confidential info.
NGOs 101: Is AI ‘ok’? Not necessarily, but NGOs should, in fact, ensure responsible use of it. To illustrate which types of data should be accessible by AI algorithms and which shouldn’t? Data such as general program information is easily accessible, but sensitive beneficiary information requires access controls.
Sure, AI can give your nonprofit a serious speed boost, but just be sure not to get in a rush at the expense of privacy. What’s your opinion on putting the pedal to the metal without sacrificing privacy?
Cybersecurity and the Problem of Shadow Technology
Did you know there’s a problem called “shadow IT”? It’s a sneaky, new problem when workers begin using digital services without any formal nod from their organization. Imagine this: a worker chooses a file-sharing app just because it’s easier to use.
Or a coworker creates an account with an AI service to get document summaries more quickly.
Perhaps a project team picks an online tool to collect beneficiary information because it’s simpler than the organization’s existing system.
All right, so sometimes we’re actually doing the right thing. But the thing is, the organization might not actually know where information is heading or who it’s reaching. In the age of AI and productivity tools online, that’s becoming more of an issue.
So, what can NGOs do?
Well, they need behavior policies that staff will actually follow. That means that if the policy is too complex, it gets disregarded; we want secure behavior to be a no-brainer.
Data Minimization: NGOs Do Not Need to Store Everything
Have you asked yourself, why should NGOs care about minimizing data? Actually, it’s way easier than it sounds! As an organization, you should first and foremost ask yourselves what information you actually need to collect and store.
But let’s be honest here, if you don’t need that piece of information, why would you need to collect it in the first place?
And if you don’t need to store it anymore, maybe you should just question yourself whether it’s worth the risk of keeping it. Ultimately, the more information you’re holding, the more you’ll have to provide secure storage for this data. So when you ask for registration for the participants of a community workshop, do you really need to collect everyone’s full telephone number and address if you just need a name and a contact? Less information is held, less risk is involved, and it is easy to manage when resources are limited.
Digital Resilience: Preparing for When Things Go Wrong
An organization cannot be sure that it will never be the victim of a cyber attack.
This is why cybersecurity must be combined with digital resilience.
Digital resilience is the organization’s ability to continue operating when technology fails or is attacked.
For an NGO, this could mean having secure backups of important documents, alternative ways of communicating, and a clear incident-response plan.
Imagine an organization that cannot get into its email accounts.
- How would it communicate with donors?
- How would staff contact each other?
- How would beneficiaries reach the organization?
- What happens if the organization’s project database becomes unavailable?
Have you ever imagined how you would handle an emergency? Resolve the what-ifs before disaster strikes. A simple action plan will identify who is in charge, what resources should be accessed, and what systems need to be protected.
But don’t take for granted your backup is going to work.
You need to test it on a regular basis. So what’s the endgame? Not that everything is perfect. Just that a single digital failure will not bring the whole organization to a halt.
Protecting Donor Information Matters Too
Thought about how important it is for your NGO to keep protection of more than just the beneficiaries’ data? You’re not alone—donor info is almost as essential. Most NGOs record a wealth of confidential info about donors: names, addresses, email addresses, donation amounts, payment info, communication preferences… the list goes on.
Imagine what could happen if this data was compromised; it wouldn’t take long for your donors’ trust to erode, and for that to have a negative influence on the reputation of your charity.
The thing is… for NGOs that rely on their fundraising capabilities, this has a direct impact on how you’ll be able to operate in the future.
Cybersecurity Is Connected to NGO Reputation
Trust takes years to build and can be damaged quickly.
When an NGO experiences a serious data breach, people may begin asking questions.
- Was the information protected properly?
- Who had access?
- How long was the organization aware of the problem?
- Were affected people informed?
- What is being done to prevent another incident?
The answers matter.
Transparency and responsible communication are important parts of responding to a breach.
Organizations should not assume that hiding an incident will protect their reputation. Depending on the circumstances and applicable laws, organizations may also have legal or regulatory obligations concerning data breaches.
Preparing communication procedures in advance can help NGOs respond more clearly during a stressful situation.
The Need for Stronger Digital Governance
Cybersecurity needs to be incorporated into your organization’s governance framework. Here’s the realization: boards, directors, and senior management don’t need to be experts on cybersecurity. But what they do need to know is that everything to do with digital security is all about risk.
- What do you do?
- Begin by putting these straightforward questions to your organization: What information do you have that is particularly sensitive?
- Where is it held?
- Who can access it?
- How regularly do you update your systems?
- Are you using multi-factor authentication?
- Do you test your backups?
- How will you deal with the loss of an important system?
- What can your users say to AI assistants?
- Who will react to a cyber attack?
These questions might enable cybersecurity to move from being just an IT problem to a real organizational priority. Organizations such as Protect. NGOs highlight the need for more resilient digital infrastructure and an increased focus on cybersecurity and technology governance, especially within the NGO and humanitarian sectors. The wider AI governance discourse is also addressing broader issues of safety, resilience, responsibility, and technology management.
The AI Era Requires a New Approach to NGO Security
You ever wondered what the NGOs of the future might look like? I bet they’ll be dealing with AI in some way or other. I’ll be able to see you dealing with a whole lot of AI assistants, data analysis that’s offloaded to the automation, digital fundraising resources, and project-management systems that think about things for you.
These tools will have the potential to give every-sized NGO the ability to do things that, in the past, could only be done with larger numbers of staff.
But with more automation, you’ve got to get a handle on your digital dependencies: what is the tool doing with my data, who is creating it, and what should I do if it all fails? Ask yourself, “Can this technology help us?” and “Are we doing it ethically?” And pay attention to the distinction.
What Smaller NGOs Can Do Today
Concerned about cybersecurity but can’t afford an expensive budget? Here’s the problem: step one isn’t even cracking open your wallet to pay for costly software. It’s actually identifying the most critical data and systems in your organization.
Begin with a simple inventory of critical accounts and data. Who has access to what? That’s your next point of consideration. Turn on multi-factor authentication on these critical accounts, and be sure to use strong, unique passwords (a good password manager can be very helpful here).
Is Your Software Updated? Keep your operating systems, apps, and websites current. Back up all valuable data frequently. Restrict access to sensitive data by roles and forget when someone leaves the company, promptly rescinding their access rights.
Equip your team with the ability to recognize phishing and malicious messages. Have guidelines on processing beneficiary and donor data? Define instructions for AI tool usage and examine the security protocols of critical third-party platforms.
What would you do if the worst happened? Draw up a straightforward incident-response plan, and don’t forget to regularly revisit your response procedures. Note: Cybersecurity isn’t a project; it’s an ongoing process.
Building Trust in a Digital Future
Technology would make a huge difference to your work! Have you considered how much digital technology could transform your nonprofit? How about connecting with more communities, engaging your donors, managing your programs more effectively, and saving time on admin?
It could happen.
And, with AI, you can make it happen even faster.
But here’s the catch: A constant focus on a band-aid solution technology cannot replace the users or prevent the downside of using it. Take that cyberattack on the Red Cross; it’s a harsh lesson learned. More than 515,000 individuals’ sensitive data was put at risk when a cyberattack hacked an archive of highly sensitive information.
With this in mind, it is imperative that NGOs get the message loud and clear that cybersecurity must go hand-in-hand with fundraising, financial management, M&E, safeguarding, and program planning. Cybersecurity is a fundamental part of good organizational governance, but above all it’s about human dignity.
Just consider it and imagine that each one of your own NGOs utilized personal data, cloud hosting, smartphones, AI, and internet-based communication tools day-to-day. But that’s a lot of consumers’ data you’re saving at the core of it. Protecting it is also about service, customer service, and communities.
As you venture further into the digital age, the importance of constructing resilient cybersecurity and digital resilience will be paramount. For only through this can technology continue to be a positive social force, not an increased threat to society.
