Cybercrime

The Charity Commission's survey explored the number of online cyber-attacks and found that more than half (51%) of charities held electronic records on their customers, with 37% allowing online donations.

Growing digital footprint

A growing digital footprint and the holding of personal data will increase a charity’s vulnerability to cyber-attacks. The most common types of attacks are phishing and impersonation, where there is an attempt to scam people into thinking emails are from the charity. This can lead to donations being made directly to criminals or a person’s data being stolen.

The survey also confirmed that there is an under-reporting of incidents when they do occur, with only 34% of affected charities reporting breaches. It’s important that charities contact the Commission when there has been a serious incident, even where it may not have a regulatory role. This helps the regulator to identify trends and patterns and to prevent others from falling victim to fraud.

There is further a legal obligation to report breaches to the Information Commissioner’s Office (ICO). In any event, the breach should be reported within 72 hours and without undue delay.

Cyber risks, many of which can be related to crime, can be divided into certain types, as follows:

LOSS OR THEFT OF DATA. Data loss happens when large amounts of customer data are deleted from a system or a phishing email, which is a fraudulent email, causes a viral infection, allowing hackers to steal data from a hard drive.

HUMAN ERROR. Data breaches are often a result of human error, which can be anything from losing a memory stick containing customer data, sending information to the wrong person and, as we’ve seen recently, an increase in organisations hitting “send all” on private emails containing personal data.

HACKING. This happens when someone maliciously gains unauthorised access to the data in your system or computer with the intent to steal it for personal use or financial gain.

VULNERABLE SOFTWARE. A weak or compromised security software system on your network could leave your charity especially vulnerable to a cyber-attack.

Responding to a cyber-attack

When a cyber-attack happens, the charity’s system will either be locked down by the attacker or they will take as much data as they can from the system, either to hold it for a ransom demand or use it to impersonate the data subject. The attacker could try to fraudulently obtain credit in the name of the charity or individuals, for example.

In addition to the requirement to report incidents to the ICO, there is an obligation to inform the subject whose data has been compromised within 72 hours, where feasible, but in any event without undue delay.

What the law says

The General Data Protection Legislation (GDPR) came into force in 2018 and governs the way we can use, process and store personal data, including any information about an identifiable, living person. The legislation applies to all organisations, including charities.

GDPR key principles require:

• Lawfulness, transparency and fairness.
• Only using data for the specific lawful purpose that it was obtained for, the most lenient of which is legitimate interests.
• Only acquiring data that is strictly needed.
• Ensuring any data possessed is accurate.
• Only storing data for as long as necessary.
• Ensuring that data is kept confidential and is secure.

GDPR rules state that personal data should be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful procession and against accidental loss, destruction or damage. It is the data controller’s, in this case the charity’s, responsibility to demonstrate compliance with UK GDPR.

Where a data controller has failed to adequately secure an individual’s personal data and it results in loss to them, the data controller will be liable to compensate the data subject for the loss suffered. Given that some data thefts involve fraudsters obtaining credit in the victim’s name, such losses could be substantial.

Article 82 of UK GDPR does however give a potential defence to any claim where the charity can demonstrate that “it is not in any way responsible for the event giving rise to the damage”. Where cyber incidents are concerned, if an affected charity is not able to demonstrate that it has fully considered its risks in respect of cyber incidents arising and taken appropriate remedial action to protect its systems and data as far as possible, it will not be able to avail itself of this defence.

Protecting against cybercrime

There are lots of simple steps that can be taken to protect against cyber harm including using strong passwords and two-factor authentication, making back-ups of your data using the cloud and making sure antivirus and all other software is patched to the latest version. Many useful tools and resources will be available to help charities reduce their vulnerability to these crimes.

Appropriate IT systems, training and procedures will give the best chance of protection but are not infallible. If the worst does happen, advice should be sought immediately from appropriate professionals in IT and legal services to deal efficiently with the aftermath of a cyber-attack.

The current cybersecurity threat landscape is extremely dangerous, with organisations from every sector being exposed to increased risk every day. Malicious threat actors and hacker groups are targeting the country’s leading organisations, from the Royal Mail to the NHS, and cyber-attacks on household name brands continue to become ever-more commonplace. However, it is not just the biggest names which are under threat. Organisations of all sizes and industries are being targeted in indiscriminate attacks, and the charity sector is no different. 

Charities are currently going through one of their most tumultuous periods from a cybersecurity perspective, with charities a prime target for cybercriminals. Recent findings from the UK government’s Cyber Breaches Survey 2023 found that 24% of charities overall recall a breach or attack from the last 12 months, down from nearly a third (30%) of charities in 2022.

Time is key

The government survey also revealed that over the last 12 months the approximate cost to a charity per breach is £530.  And it’s likely that these numbers are much higher, especially if the affected charity doesn’t have the processes, practices and protections in place to remove the attacker and get back up and operating, quickly. When it comes to cybersecurity, time is key, and the longer disruption to services goes on, the more costly and catastrophic a breach will be. 

The situation for charities is being worsened further by the monetisation of cybercrime, which continues to grow at an alarming rate. Experts estimate that the cost of cybercrime to businesses will reach $10.5tn by 2025, making it the third biggest economy after the US and China. The issue isn’t going away, and charities must adopt a new approach to ensure they are as protected as possible. 

Unfortunately for charities, they often offer a lucrative target for malicious cyber groups due to the amount of valuable public data they hold. Criminals often consider them an easier target too, some with weaker security postures due to the challenge of balancing public funding against spiraling cybersecurity costs.  

THE EXTENT TO WHICH CYBERSECURITY IS A PRIORITY FOR CHARITIES. The reality is that top of the range cybersecurity products simply aren’t attainable for many charities. With stripped back funding for areas such as cybersecurity, it is difficult for the charity to explore many security processes which have become commonplace in the private sector. 

Within this year’s Cyber Breaches Survey, the government found that just 27% of charities have undertaken cyber security risk assessments in the last year, while less than a fifth (19%) have deployed security monitoring tools. On top of this, only 11% of charities say they review the risks posed by their immediate suppliers, and just a third of those surveyed have cyber insurance policies in place. 

Board level awareness

Decisions about where funding is distributed within an organisation start at the board level, and having engaged, cyber-aware board members can make a huge difference for any organisation, especially charities. The Cyber Breaches Survey discovered that nearly three in ten charities (31%) have board members or trustees explicitly responsible for cybersecurity as part of their job role, while 9% of corporate annual reports across charities covered cyber risks. 

These numbers are concerning, and highlight the lack of investment from charities into their cyber hygiene not only from a funding perspective, but also from a resources and focus point of view, with many seeming to operate on a “hopefully it won’t happen to me” mindset. And while this way of thinking is still commonplace among many sectors, and previously may have worked, today it is simply not enough to think this way.  

Attacks are becoming ever-more sophisticated, malicious threat actors are becoming increasingly knowledgeable and experienced, and the cost of remaining secure continues to skyrocket. That’s why a pragmatic and appropriate cybersecurity strategy is absolutely crucial for charities. 

WHAT CONSTITUTES A CYBERSECURITY STRATEGY AND ITS IMPORTANCE. In essence, a cybersecurity strategy is a plan set out by organisations to minimise their risk, improve their security stature, and to lay out the necessary steps to respond should an incident occur. A comprehensive cyber strategy should encompass Risk Assessment, Risk Prevention, Supplier Management, Data Visibility and Management, Testing, Validation, and Hardening. 

In simpler terms, your cybersecurity strategy should take into account every possible eventuality. From risk assessments before an attack has taken place and risk management to cut off potential attack vectors, all the way to testing, patching, validation and hardening to ensure your security stature remains robust.  A comprehensive incident response plan is a must which assigns each person a role to help mitigate the damage caused when an attack occurs.  

Clear picture of vulnerabilities

The reason this strategy or plan is so critical is that without one, charities are fighting with a blindfold on and one arm behind their back. When a cybersecurity strategy is properly planned and executed, it gives you a clear picture of where your vulnerabilities lie, how to fix them, and what to do if one is targeted. This information gives you visibility of your environment and how it is operating, which is one of the most important aspects to remaining cyber secure. 

Cybersecurity is all about ensuring an appropriate response to your risk. And unless you know exactly what your risk looks like, it is impossible to calculate the right response. 

PROTECTING YOUR CHARITY WITHOUT OVERSPENDING. The fact remains that cybersecurity can be expensive, and the cost is continuing to rise every day. Hiscox’s 2022 Cyber Readiness Report discovered that the average spend from companies with 250 to 999 employees had doubled since the year previous. For organisations with more than 1,000 employees, this had risen by 65%. For the larger organisations, the spend had risen nearly fivefold in three years previous, to nearly $20m.  

However, when looking at smaller firms a very different picture is being painted. For organisations with 10 to 49 employees, they have almost halved their cybersecurity spending, from $411,000 to $225,000, while those with less than ten employees had cut spending drastically from around $150,000 to $29,000. 

These figures suggest suggests that the organisations which can afford best protection are spending more, but this isn’t smaller businesses and charities, who have been impacted in recent years by the pandemic and other strenuous factors.  

HOW CHARITIES CAN BUILD A STRATEGY ON A BUDGET. The key for charities is to have a plan which is proportional to their risk, and this risk will look different for each individual charity. However, some things remain the same. 

EMPLOY SOLUTIONS WHICH ARE LOW COST BUT EFFECTIVE. While many of the top level security protections have high prices associated with them, there are many extremely effective solutions which don’t require such a large investment.

Two factor authentication

One of these is two factor authentication (2FA), which requires users to provide two sets of information, often from different devices, in order to access data or accounts. This often costs little to nothing to implement, and makes it very difficult for malicious threat actors to breach environments using leaked passwords or other compromised credentials. 

FOCUS ON STAFF TRAINING AND AWARENESS. It's often said that the biggest cybersecurity risk still sits between the keyboard and the chair, and it is true. According to a report by IBM published in 2022, human error accounted for 95% of cyber breaches. This is a massive statistic, and one that charities can lower with the right activity.

Ensure that employees are aware of your charity’s cyber safety practices and processes, and provide training and awareness so that they know how to spot an online scam. Phishing is one of the biggest attack vectors, and almost always targets someone working within an organisation. If staff are cyber aware, they can stop attacks before they’ve even begun.

PROCESSES OVER SOLUTIONS. If charities are operating on a very small budget, they shouldn’t feel pressured to invest in expensive, cutting-edge technologies that may or may not be proportionate to their level of risk. Instead, they should be looking at the basics, such as firewalls and anti-virus, and then investing time and resources into improving their processes.

Some of the best practices include segmenting your data and revoking permissions – meaning that people can only access the parts of your environment, data and assets that they need to complete their job. And so, if a user is compromised it contains the attack and protects the rest of the online environment from also being breached.  

Cyber hygiene

As the latest government data shows, charities are challenged by the threat of cybercrime and staying safe online. They have become a lucrative target for malicious groups, and are able so readily able to secure the funding they need to ward them off consistently. So, what they must focus on is cyber hygiene; don’t make it easy for attackers. Remaining protected on a budget is possible, however it is something that the entire charity must buy into. 

The vast amounts of sensitive data, online transactions, and the reliance on digital platforms make charities prime targets for criminals who continue to explore and exploit our increasing reliance on technology and online platforms. In November 2023, data from Action Fraud revealed fraudsters diverted more than £2.7m from charities in the 12 months prior and that there were 501 charity fraud crime reports between 1 November 2022 and 31 October 2023. 

As with any crime, if you have suspicions of wrongdoing within a charity, you should report the matter as soon as possible to the necessary authorities. Examples of issues may include:

• A charity not following the law, with damaging consequences to its reputation and public trust in charities generally.
• A person or organisation receiving significant financial benefit from a charity.
• Criminal, illegal or terrorist activity.
• A charity losing substantial amounts of money.
• A charity losing significant assets, for example, land or buildings.

Fraud and cybercrime are police matters and should also be reported accordingly, but trustees should also report to the Charity Commission, which plays a vital role in assessing whether criminal activities indicate mismanagement in the charity and whether they need to act to protect the organisation.

An incident response plan

Charities should always be prepared for the worst case scenario. An incident response plan is helpful to outline the steps to be taken in the event of a cyber incident, including communication protocols, responsibilities and legal obligations – as well as who should be contacted and when.

Dedicated cybersecurity insurance is also now readily available to mitigate the financial impact of such an attack. It’s worth investing in, but be sure to carefully review policy terms and conditions to ensure coverage aligns with your charity's needs.

Safeguarding your charity from fraud and cyber threats requires a proactive and comprehensive approach, and there are several steps to consider:

Secure your network

Being more fraud-aware and identifying potential vulnerabilities, such as in IT software, banking systems and websites, is the best place to start.

Ensure your charity's network is secure using firewalls, antivirus software, and intrusion detection systems. Regularly update and patch all software to address vulnerabilities and avoid exploitation by cybercriminals. I’d also highly recommend implementing a virtual private network (VPN) to encrypt internet connections and protect sensitive data if not in place already.

Educate your team

As well as systems, people pose a threat to security against criminals – whether it’s those you employ or contractors you work with. The first line of defence against fraud or cybercrime is an informed and vigilant team.

Cyber threats and fraud methods constantly evolve, so keeping a finger on the pulse is essential. Subscribe to cybersecurity news feeds, attend conferences and engage with industry experts – this knowledge will empower your charity to adapt and implement effective safeguarding techniques as required.

In addition to implementing a cybersecurity policy, you should conduct routine training sessions to educate your team about the latest threats, phishing techniques and best practices for online security. Encourage an innate level of scepticism, where it’s second nature for employees to verify the authenticity of emails, links and requests for sensitive information.

Backing up and passwords

If your charity falls victim to a cyberattack or data breach, the first thing you’re likely to panic about is accessing your data, so having regularly updated backups is vital. Put a backup and recovery strategy in place to ensure that essential data can be restored quickly and store backups in a secure and separate location to prevent them from being compromised.

The most common gateway for criminals is through weak passwords, which can be avoided through a robust password policy. Insist on team members using strong passwords that require a combination of upper case and lower case letters, numbers, and symbols. These should be regularly updated alongside the use of multi-factor authentication (MFA) where possible.

Protect sensitive data

Together with backing up data, making every effort to protect it day-to-day is critical, and the information your charity collects, such as donor details and beneficiary info, should be handled with utmost care.

Encrypt sensitive data at all times – whether saved on a device or being sent externally. It’s also good practice to regularly audit and categorise data based on sensitivity. From here, you can limit the number of employees with access to the most sensitive data and conduct any necessary background checks on those handling such information.

When handling financial transactions, charities must use secure and reputable payment gateways to process donations online. Additionally, accounts teams should closely monitor statements and transactions for any irregularities. You should have a clear process in place to verify that any financial requests are legitimate – no matter the value.

Remaining compliant

Data protection laws and regulations are constantly evolving, but keeping tabs on and adhering to these standards are vital. A commitment to compliance will not only protect your charity from a legal perspective but also your reputation, as it reassures the public that you value ethical practices and data security.

Reduce the stress of maintaining standards by working with regulatory professionals such as cybersecurity experts, risk management consultants and lawyers to ensure your charity benefits from the latest expertise in the field.

Support is also available from the Charities Against Fraud coalition – a cross-sector group of around 50 organisations which work together to fight crime targeted towards charities. These include police and crime prevention organisation Action Fraud and other sector initiatives such as the Fraud Advisory Panel, Get Safe Online, Charity Finance Group, and the Credit Industry Fraud Avoidance Service (CIFAS).

Additionally, there are several government departments and agencies dedicated to combatting cybercrime and fraud, such as the National Cyber Security Centre (NCSC), HMRC and National Trading Standards.

Cybercrime and fraud are genuine issues that must be taken seriously. Only recently was it revealed that Age UK was investigating after trustees discovered fraudulent losses of almost £460,000. Every member of your charity, from volunteers to executives, plays a role in protecting against fraud and maintaining cybersecurity.

Foster a culture of accountability by clearly defining each individual's responsibilities, encouraging the prompt reporting of suspicious activities and communicating the consequences for non-compliance with security policies. A proactive, thorough and vigilant approach will futureproof the long term success and impact of your charity’s endeavours.

In its Preventing Charity Cybercrime report, the Charity Commission revealed that 58% of charities think cybercrime is a major risk to the sector. Yet despite understanding the dangers charities, and small charities in particular, are failing to do enough to protect themselves. Charities are more vulnerable to cybercrime than any other organisation. This is the warning that has come out from the Charity Commission which found more than half of charities recognised the threat was a very real problem to their operations.

Not only do charities hold valuable stakeholder and donor data, they often have less robust systems and controls in place to protect themselves. And this is why criminals are increasingly targeting the sector with phishing, ransomware, social engineering, malware, phreaking, a virus, website defrauding and hacking - with some facing devastating consequences.

According to the Government’s Cyber Security Breaches Survey 2019, almost a quarter of charities were affected by cybercrime last year. And yet despite these figures, 44% admitted they are not adequately protecting themselves.

Protective systems will help

When it comes to protection for cybercrime it’s high time charities quashed the “head in the sand” attitude. They can start by getting IT systems up to scratch. Ideally you should outsource all your IT provision to a professional - but at the very least you should make sure you always update and upgrade when required.

Last year the UK’s National Cyber Security Centre (NCSC) published a guide to highlight the growing risk of cybercrime to help small charities protect themselves from the most common types of attack. Among its recommendations, the guide advised charities to back up data and protect it with strong passwords, protect the organisation from malware and keep smartphones and tablets safe.

An external expert will help you install a firewall, antivirus software, PKI Services (cryptographic technique for insecure public networks), managed detection services, penetration testing and can assist you with your staff training. The best system for your budget will help deter criminals and should drastically reduce your risk of a breach. But remember, no system is fool proof.

Train your staff

The next course of action for protection is proper staff training. The sector identified phishing attacks - where criminals specifically target charities with fraudulent emails - as a huge problem, especially as more and more criminals use machine-learning algorithms to fine-tune content.

The rise in the number of these incidents is likely to be the result of poor training - with staff and volunteers at charities statistically less likely to be given proper guidance than employees in commercial organisations.

Phishing emails frequently attempt to trick staff into installing ransomware – a type of malware – on a charity’s computer systems. This then increases the charity’s likelihood of falling victim to a ransomware attack. Many organisations believe that they can mitigate a ransomware attack by ensuring that they have high-integrity backups of their systems so they can restore their data if it becomes encrypted.

But, disturbingly, ransomware is increasingly being equipped with extraction capabilities, allowing hackers to steal confidential information such as usernames and passwords before encrypting data. This means that even if a charity restores its systems, the criminals can come back later and gain access again.

Training would help staff identify issues of concern – but it would also help employees spot other problems that could result in breaches. This is particularly important in relation to fraud.

After all, according to the Charity Commission, more than two thirds of charities (69%) think internal insider fraud is the biggest potential threat to the sector, backed up by the fact that 30% of cybercrimes were identified by internal IT controls last year.

Studies suggest charities are vulnerable to internal fraud because of a lack of fraud awareness training, an over-reliance on goodwill and trust, and excessive trust in one or more individuals.

To prevent internal fraud becoming a problem, there are some basic steps all charities should take. These include introducing and enforcing basic financial controls – such as having two signatories to bank accounts and undertaking regular bank reconciliations. On top of this, charities should make sure no one single individual has oversight or control of financial arrangements.

The Charity Commission reports that astonishingly, less than a third (30%) of charities have a whistleblowing policy but staff, volunteers and trustees should be encouraged to speak out if they see something they feel uncomfortable about.

Get your insurance in place

The final weapon in your armoury against cybercrime should be your insurance.

According to the Department for Digital, Culture, media and Sport’s Cyber Security Breaches Survey 2019, the average cost of identified data breaches and attacks in 2019 for charities was £2,150. A sobering thought. Some charities, particularly the larger charities with better funded resources, are aware that their data is sensitive, valuable and vulnerable and will install the best IT systems to protect it.

But, sadly, there remains a staggeringly low adoption rate of cyber liability insurance among charities and this would be a sensible addition to any charity’s armoury. According to a survey by the Department for Digital, Culture, Media & Sport, completed last year, just 4% of charities said that they have some kind of specialised cyber liability insurance in place, while 17% of charities said they were unaware such a thing existed.

Mixed perceptions about the cyber liability insurance market mean that there is a degree of scepticism and confusion about exactly what this insurance covers and how effective it would be in the event of a claim. So, let’s take a look at this.

Minimise your losses

It’s true that not all cyber liability insurance policies are the same. Equally, not all cyber threats can be anticipated or prevented. However, a specialist insurance broker, insurer or other insurance specialist can help you work out the risks, the estimated cost of a breach and bring to your attention a package which can be integrated as part of your charity’s risk management process.

As well as using a broker or other expert, you should make sure you understand what's covered and what you get in terms of training, helplines, access to experts and that you know the different risks.

The impact of cybercrime can be far-reaching for any charity. Loss of income could occur if a hacker accesses your network and causes damage to your systems or data, leaving you unable to operate and earn revenue.

Further costs from a serious data breach might involve legal advice, and time and money informing clients or regulators about the data breach. This may lead to you having to defend and settle claims made against you in the event personal data is lost or stolen. There can also be further costs connected with regulatory investigations and paying penalties imposed by regulators.

Meeting the costs of repair, restoration or replacement of websites, programs or electronic data following a computer hack can also be a burden, and if you’ve been the victim of extortion you may be out of pocket if a criminal holds you to ransom. On top of this, there is the cost to your reputation.

The best cyber liability insurance covers the costs associated with security breaches, loss of third party data and cyber extortion, as well as access to expert IT advice and support, cyber forensics, legal advice and public relations in the event of an attack.

By sending in the cavalry, this package will help cushion the financial impact, get a charity back on its feet and mitigate any reputational damage that may result from negative publicity.

It pays to be prepared

Charities recognise the risks. They know the threat is there and that the attack could cost them dearly. However, all too often charities see cybercrime as just an IT issue. They think that if they put robust IT measures in place, they are safe. But the fact is that even with excellent systems, there can be breaches.

The latest research from the Charity Commission should act as a stark warning for charity decision-makers. And it’s time to act. Charities need a three-pronged approach to cover themselves: excellent IT protection, well trained staff and the right insurance cover. Without it, you might as well leave your office unlocked and ask your staff to leave the door wide open when they leave.