Charities urged by Azets to strengthen their cyber security

Charities are being urged to urgently strengthen their cyber security measures to protect donor data from potential breaches.

The warning comes from Siobhan Holmes, a specialist in not-for-profit organisations such as charities and a partner at Azets, who raised the alarm following a recent hack affecting a customer relationship management (CRM) platform used by more than 1,000 charities.

Ms Holmes said: "The hack highlights just how dependent the fundraising sector has become on shared technology providers.

"For hackers, many charities have an 'Achilles’ heel' when it comes to IT, shooting their virtual arrows through thin firewalls to wreak havoc.

29 holiday units among the latest planning applications submitted in BCP area What's on in Bournemouth, Christchurch and Poole cinemas this weekend Lymington antique dealer discovers astonishing relic from First World War raids Weather forecast for Bournemouth over upcoming weekend £60,000 appeal launched to rebuild lost Victorian canopy at Corfe Castle station

Siobhan Holmes, who specialises in not-for-profit organisations such as charities, is a partner at UK top 10 accountancy and business advisory firm Azets. (Image: Azets/Deep South Media)

"Charities do need to significantly strengthen their cyber security to avoid customer data being stolen and used to commit financial fraud such as taking out credit cards or loans in the names of donors."

She emphasised that encryption alone is not enough, and called for stronger identity and access management, as well as robust policies.

Charities rely on CRM systems to process donations, manage memberships, sell event tickets, and to customers.

Ms Holmes said the breach should prompt charity leaders to ask not only their own security, but also the security of their suppliers.

She said: "With cyber attacks continuing to affect organisations across the sector, cyber resilience must be viewed as a fundamental part of governance, risk management and safeguarding public trust.

"Protecting beneficiaries, donors and sensitive data is no longer solely the responsibility of IT teams – it's the responsibility of people in charge of the charity which includes the trustees who perhaps are out of their depth when it comes to IT."

She urged boards to make cyber security a standing agenda item for Board meetings to ensure strong governance and challenge by the trustees.

The recent breach was enabled by a single compromised AWS access key, highlighting the need for rigorous credential management and access controls.

Ms Holmes said: "Although the data was encrypted at rest, the attacker used valid credentials to access and download information in a readable form.

"Encryption alone is not enough.

"Strong identity and access management are equally vital.

"If major corporate brands such as Jaguar Land Rover and M&S can be hit, so can charities."

There are nearly 171,400-plus registered charities in UK, with 1.7m employees, 6.5m volunteers and more than 921,000 trustees.