Nonprofit Data Breach Statistics (2026)

Deep dive into nonprofit cybersecurity incidents, breach costs, attack trends, and preparedness gaps. Essential reading for nonprofit leaders protecting donor and beneficiary data.

Nonprofit organizations hold some of society's most sensitive data—donor names and financial records, client personal information, volunteer details, and grant documents. Yet nonprofits have become the second most targeted sector by cybercriminals , facing a growing wave of sophisticated attacks with limited resources to defend themselves. This report analyzes the latest nonprofit data breach statistics and cybersecurity threats, part of our nonprofit technology statistics hub.

Methodology & Honesty Note: This report draws from 20+ authoritative sources including the Identity Theft Resource Center (ITRC), state data breach registries, academic research (NPCIR), nonprofit benchmarks (NTEN, Protect.ngo), and government cybersecurity surveys (UK DCMS, HIPAA OCR). Every statistic is sourced; we exclude figures we cannot verify. For data from prior years (2021–2024), we note the publication date clearly. Nonprofit data breach reporting remains incomplete—many breaches go unreported—so these figures represent reported incidents only.

Key takeaways

3,322 total U.S. data breaches in 2025 (record high)

68% of nonprofits hit by breach in past 3 years

$2M average nonprofit data breach cost

35% rise in nonprofit email threats (YoY)

Scale of the Threat: Record Breaches Across All Sectors

According to the nonprofit Identity Theft Resource Center (ITRC), the number of data breaches reported last year reached an all-time high in the U.S. with 3,322 being reported, representing a 4% increase over the previous year. This sets the backdrop for nonprofits: in a year of unprecedented breaches nationwide, the charity sector remains a high-value target.

Religious/Nonprofit organizations accounted for 4% of the 2,349 total breaches reported to the North Carolina Department of Justice in 2025 (91 breaches).

68%

60%

Left: CyberPeace Analytical Report ; Right: NTEN Nonprofit Cybersecurity Report

Email Attacks and Phishing: The Primary Vector

Nonprofit organizations have seen a sharp rise in cyber-attacks, with email-based threats increasing by 35.2% over the past year. This surge stems from nonprofits' heavy reliance on digital fundraising and remote collaboration, combined with their high-trust environments that attackers exploit ruthlessly.

Credential phishing targeting nonprofits surged 50.4%, enabling attackers to access donor databases, financials, and internal communications. Malware attacks on nonprofits grew 26.2%, with malicious attachments disguised as invoices or grant approvals as the primary delivery method.

Email-based threats +35.2%

Credential phishing +50.4%

Malware attacks +26.2%

Year-over-year attack increases on nonprofits. Abnormal Security (2025)

Attack Types: Ransomware, DDoS, and Data Theft

Availability-related incidents, particularly ransomware and distributed denial-of-service (DDoS) attacks, constitute the most prevalent threats, while confidentiality breaches remain highly significant due to frequent data exposure incidents.

For nonprofits specifically, external system breaches accounted for a staggering 74% of nonprofit data breaches. Availability-related incidents, particularly ransomware and distributed denial-of-service (DDoS) attacks, constitute the most prevalent threats.

External system breaches 74%

Phishing (common) 83%

Business email compromise 35%

Breach types and attack vectors affecting nonprofits. RipRap Security (2025)

Financial Impact: Devastating Costs to Mission

The average cost of a data breach reaching up to $2 million. This includes direct costs (recovery, forensics, legal) plus indirect losses (downtime, reputational damage, donor churn). The average ransom demanded in a ransomware attack increased by nearly $1 million in 2024 compared to 2023.

The average length of interruption after ransomware attacks on organizations in the United States in 2021 was 22 days. On average, breaches were discovered 467 days after they occurred. This delay—over a year—means attackers have extended time to exfiltrate data, escalate their access, and cause maximum damage.

Estimated trend in average nonprofit data breach costs. BDO (2025)

Preparedness Gaps: The Nonprofit Cybersecurity Crisis

Despite rising threats, 70% of nonprofits lack a formal cybersecurity policy, making them easy prey for hackers. 4 out of 5 organizations do not have any cybersecurity plan. Further compounding vulnerability:

No formal cybersecurity policy 70%

Do not monitor networks 75%

Lack regular staff training 90%

No MFA required for login 56%

Nonprofit cybersecurity gaps and missing protections. BoardEffect; CyberCommand; NTEN

56% of NGOs do not have a budget allocated for their cybersecurity needs, while 70% of them do not believe to have the knowledge, skills, and resilience necessary to respond to a cyberattack.

Breach Detection & Disclosure Transparency Issues

A troubling trend undermines public trust: Organizations providing clear details on how breaches happened declined from nearly every organization in 2020 to just 30 percent (30%) by the end of 2025. This means victims and donors are left in the dark about their exposure, unable to take protective steps.

Detection delays compound the problem. Breaches were discovered 467 days after they occurred. This delay is significant, as the longer an attacker has access to a compromised system, the greater the potential damage.

30%

81%

Transparency decline and primary attack vectors. ITRC (2026)

International and UK Charity Sector Insights

Similar patterns emerge globally. According to the UK Government's Cyber Security Breaches Survey 2025, 30% of charities experienced a cyber breach or attack in the past year, which equates to around 61,000 organisations. Phishing remains the most common attack method, affecting 86% of charities that reported a breach.

While the average cost of the most disruptive breach for a charity is estimated at £3,240, some organisations have faced losses as high as £350,000.

Larger charities face worse odds: This is much higher for high-income charities with £500,000 or more in annual income (66%).

What this means for your volunteer program

Nonprofits collect vast amounts of sensitive data on volunteers, donors, and beneficiaries—exactly what cybercriminals target. Protecting this data requires both technical and people-focused measures:

Vet your people: Nonprofits' reliance on volunteers lacking cybersecurity training and ties to enterprises makes them viable supply chain attack entry points. A verified volunteer screening process with proper onboarding reduces insider risk and phishing surface area.
Verify backgrounds: Identity verification and character screening help you trust the hands that touch your data. VolunteerBadge offers FCRA-compliant background checks at $5 per check with no monthly fees—perfect for nonprofits managing large volunteer rosters with tight budgets.
Implement MFA: 56% of nonprofits don't require multi-factor authentication (MFA) to log into online accounts. Require it for all donor database and volunteer platform access.
Train staff and volunteers: Phishing remains the most common form of attack on charities. Technical measures are important in stopping these attacks but the strongest link remains staff and volunteers, who have a critical role in protecting the organisation. Appropriate policies and training are vital. See our volunteer screening guide for integration best practices.
Document and incident-respond: Some 19% of charities said they had formal incident response plans and this rises to 50% of charities with an income over £500,000. Create a written plan before you need it.

For nonprofits managing compliance and volunteer safety, batch volunteer importing and character reference checks streamline trust-building at scale. Sign up for VolunteerBadge today to add a verified layer to your volunteer data security program.

Download the data

⬇ Download the data (.xlsx)

Frequently asked questions

Q: How common are nonprofit data breaches?
A: 60% of nonprofits have reported experiencing a cyberattack in the last two years. 68% of nonprofits participating in the research have experienced a data breach in the past three years.

Q: What is the average cost of a nonprofit data breach?
A: The average cost of a data breach reaching up to $2 million. However, The average data breach costs nonprofits $200,000 according to IBM Security (accounting for smaller incidents). Ransomware averages much higher.

Q: What is the most common attack on nonprofits?
A: Phishing remains the most common attack method, affecting 86% of charities that reported a breach. These are followed by business email compromise (BEC) and malware delivered via email attachments.

Q: How long does it take to discover a nonprofit breach?
A: Breaches were discovered 467 days after they occurred. This 15+ month average is a critical vulnerability window.

Q: Are nonprofits targeted more than other sectors?
A: Yes. Nonprofit organizations have become the second most targeted sector by cybercriminals, accounting for 31% of all notifications of nation-state attacks against organizational domains. Nonprofits have become prime targets due to their limited cybersecurity resources, high-trust environments and frequent financial transactions.

Q: What should a nonprofit do after a breach?
A: A large majority of organisations say that they will take several actions following a cyber incident, in reality a minority have agreed processes already in place to support this. These findings are consistent with previous years. Create a formal incident response plan now, before a breach occurs. This should include notification procedures, forensic investigation contacts, and stakeholder communication templates.

Sources & references

First published: October 6, 2026
Last updated: October 6, 2026

This is a living report. We refresh it annually with new breach data, research, and nonprofit cybersecurity trends from ITRC, government surveys, academic partners, and industry benchmarks. Check back next October for 2027 updates.

Educational resource, not legal or cybersecurity advice. Consult qualified professionals for your organization's specific risk profile and compliance needs.