.png)
Earlier this month, a cyber-security incident at a major charity-sector CRM provider put donor and beneficiary data at roughly 1,500 UK charities at risk, including organisations working in healthcare and victim support.
The entry point, by the provider's own account, was compromised credentials. Attackers didn't need to break through a sophisticated defence. They just needed one set of login details.
Why This Keeps Happening
Charity CRMs sit on a goldmine of sensitive data; donor details, contribution history, beneficiary records, sometimes information about people in genuinely vulnerable circumstances. However, security budgets in the sector are often stretched thin, and CRM vendors don't always treat security as a competitive differentiator the way a bank, for example, would have to.
The common thread in most CRM breaches isn't exotic hacking. It's:
- Credentials that get reused, phished, or leaked
- No enforced MFA, or MFA with an admin bypass
- Flat access, where anyone with a login can pull the whole database
- Backups that are "encrypted" in name but not access-controlled
Is It Avoidable? Yes.
None of this requires cutting-edge technology. It requires treating credential compromise as inevitable, and designing around it rather than hoping it doesn't happen:
- Mandatory MFA, no exceptions — including for admin accounts, which are usually the highest-value target and the ones most often left out of MFA rollouts
- Least-privilege access by default, so one compromised login can't export an entire donor database
- Anomaly detection on bulk exports — a full database download at 3am should raise a flag, not just sit quietly in a log
- Genuinely access-controlled encrypted backups — not encryption as a checkbox item, but backups that a compromised account still can't freely pull from
The Bottom Line
Your supporters didn't sign up to have their data become a headline. Neither did you.
The recent breach isn't a freak event, it's what happens when credential risk is left to chance in a sector where security budgets rarely get the attention they need. The fix needs to happen before the incident, not after.
The good news: these gaps are checkable. If you're not sure whether your own organisation's data has already surfaced in a breach or want to know how much data has been surfaced, we're offering a free Breach Awareness Report, a direct answer in a few minutes, with no cost or obligation.
Get your free Breach Awareness Report →