In short
- ✓28% of UK charities reported a cyber breach or attack in the last year, according to the government's Cyber Security Breaches Survey 2026.
- ✓Phishing is the most common attack, affecting a quarter of charities.
- ✓Trustees must report serious incidents, including significant cyber attacks and data breaches, to the Charity Commission.
Why charities and community organisations are targeted
Charities hold donor details, Gift Aid records, bank details and often sensitive information about the people they support, usually with small budgets, part-time staff and volunteers using their own devices. That mix makes charities an easy target, and a breach can damage the trust that donations depend on.
The good news is that most of the protection a small charity needs is low cost. Microsoft and Google offer free or discounted plans for registered charities, and the basics, multi-factor authentication, backups and simple training, close most of the gaps. We help Surrey charities and community groups put them in place, at a fixed price that fits a charity budget.
The main risks
- Phishing and fake invoice emails sent to treasurers, finance volunteers and trustees.
- Hacked email accounts used to ask supporters for donations or bank details.
- Donor, Gift Aid and beneficiary data spread across personal email accounts, spreadsheets and volunteers' devices.
- Former volunteers and staff who still have access to shared accounts and files.
- Personal data breaches that may need reporting to the ICO within 72 hours, and serious incidents that trustees must report to the Charity Commission.
- Weak security at suppliers such as CRM, fundraising and mailing platforms.
How we help charities and community organisations
- Microsoft 365 & Google Workspace SecuritySet up charity Microsoft 365 or Google Workspace securely, with multi-factor authentication and an end to shared passwords.
- Staff Cyber Awareness TrainingShort, friendly training for staff, volunteers and trustees on phishing and fake invoices.
- GDPR & Data Protection SecurityPractical controls for donor and beneficiary data, plus a simple breach response plan.
- Email Security & Phishing ProtectionDMARC so criminals can't send email pretending to be your charity.
- Cyber Essentials Certification SupportEvidence for funders, grant makers and partners that your charity takes data protection seriously.
Cyber security checklist for charities and community organisations
- Turn on multi-factor authentication for email, banking, CRM and fundraising platforms.
- Give every staff member and regular volunteer their own account instead of shared logins.
- Remove access promptly when volunteers, staff or trustees leave.
- Confirm any change to supplier or payee bank details by phone before paying.
- Keep donor and beneficiary data in one secure system, not personal email or USB drives.
- Back up important data and test restoring it.
- Give trustees a short annual cyber briefing and agree who reports incidents.
- Use the NCSC's free Small Charity Guide as a starting point.
Questions
Do charities have to report cyber attacks?
Trustees must report serious incidents, those that cause or risk significant harm to the charity, its beneficiaries, assets or reputation, to the Charity Commission. Personal data breaches may also need reporting to the ICO within 72 hours.
Is cyber security affordable for a small charity?
Yes. Most of the important protections are low cost or already included in charity Microsoft 365 or Google Workspace plans. We agree a fixed price up front.