Internet Phishing Schemes: How to Protect Your Nonprofit From Cyberattacks

The COVID-19 pandemic has resulted in numerous risks for nonprofit organizations. In addition to health-related risks and financial challenges, the pandemic has intensified the threat of cyberattacks. Hackers have grown more sophisticated in recent years. They often target nonprofits because charities hold confidential donor data but may fail to safeguard such data.

And the cost of a cyberattack can be steep. According to the IBM Security “2021 Cost of a Data Breach Report,” breaches initiated through phishing schemes had an average total cost of more than $4.65 million per incident. You owe it to your stakeholders to stay current on hacking threats and do what’s necessary to secure your systems.

What’s phishing?

Most attacks are made via phishing schemes, where cybercriminals dupe victims into providing personal information (including login credentials). Phishing emails generally include links or attachments that, when clicked, infect computers with malware that enables fraudsters to unlock your systems.

For example, someone on your staff might receive an email with a link to a “spoof” (a fake site that looks like that of a reputable company) of a legitimate document-sharing site, such as Dropbox or Office 365. Once the criminals obtain that employee’s login information, they’ll have access to all of the information stored on the staffer’s computer, as well as access to your nonprofit’s network. This can include donor data, accounting records and HR information about employees.

Increasingly, cybercriminals are using phishing emails to perpetrate ransomware attacks. They gain control of an organization’s network and data and lock legitimate users out. They then hold the data hostage until the victim organization pays a ransom. The criminals might leak some confidential information to the public or on the “dark web” to show they’re serious and to encourage quick payment. Most ransomware perpetrators release the data after they receive a ransom — but not always.

What prevention training can be done?

Don’t think that nonprofits are immune from cyberattacks, including ransomware demands. Criminals have hacked everything from government agencies to hospitals to large charities, so it’s critical that you act defensively and provide training to all staffers. Training should cover various phishing schemes and include testing so employees can see how easy it is to fall prey to scams.

Red flags of phishing include messages with a sense of urgency, such as a subject line that says, “Are you available right now?” Or subject lines might include references to upcoming meeting agendas, job applications, payroll questions and password verifications. Still others may reference important messages from HR regarding vacation or COVID-19 policies.

In addition, phishing messages frequently are peppered with bad grammar and misspelled words. They may use numbers and special characters that look like letters to dodge anti-phishing software. And, of course, they usually include URLs that are close, but not identical, to the addresses of real company sites.

Are there other security steps?

To fend off cyberattacks, your organization should consider using password managers. A surprising number of employees still use easily hacked passwords such as 1234 and PASSWORD. Password managers generate much more complex passwords and store them for users. At the very least, require employees to come up with complex passwords and change them frequently.

Two-factor authentication — which requires users to log in normally and confirm their identity via text or phone — is also advisable. And be sure to implement hardware and software updates on a timely basis. Finally, stop using programs that are no longer supported by their makers.

Ask for help

Staying on top of your cybersecurity takes effort. We can help you take the next steps.

© 2022

Information provided on this web site “Site” by Thompson Greenspon is intended for reference only. The information contained herein is designed solely to provide guidance to the user, and is not intended to be a substitute for the user seeking personalized professional advice based on specific factual situations. This Site may contain references to certain laws and regulations which may change over time and should be interpreted only in light of particular circumstances. As such, information on this Site does NOT constitute professional accounting, tax or legal advice and should not be interpreted as such.

Although Thompson Greenspon has made every reasonable effort to ensure that the information provided is accurate, Thompson Greenspon, and its shareholders, managers and staff, make no warranties, expressed or implied, on the information provided on this Site, or about any other website which you may access through this Site. The user accepts the information as is and assumes all responsibility for the use of such information. Thompson Greenspon also does not warrant that this Site, various services provided through this Site, and any information, software or other material downloaded from this Site, will be uninterrupted, error-free, omission-free or free of viruses or other harmful components.

Information contained on this Site is protected by copyright and may not be reproduced in any form without the expressed, written consent of Thompson Greenspon. All rights are reserved.

Share: