Why experts fear Canada's not-for-profits are prime targets for hackers - CBC

Paul Nichol's reaction to the Crime Stoppers data breach was immediate recognition of the vulnerability shared by non-profits across Canada. "Holy crap, this happens every day," he told CBC News, describing the breach as a "real wake-up call" for his organization, Community Futures, which collects sensitive personal information including social insurance numbers.

Nichol's non-profit fends off three or four phishing attempts weekly, but the constant threat lingers. "There's always that little dark cloud behind you saying, 'Is today the day we're going to get hacked?'" he said. His experience reflects a broader concern among cybersecurity experts who view the Crime Stoppers breach not as an isolated incident but as part of a growing pattern targeting non-profits.

Prime targets for hackers

Non-profits have become prime targets for cybercriminals and state-backed actors due to the valuable data they collect and their often-limited defenses. "Non-profits are targeted by everyone," said Stéphane Duguin, CEO of the Geneva-based Protect.ngo Foundation. Beyond common phishing attacks, they face sophisticated, politically motivated hacks aimed at disrupting their work or destroying credibility.

Prominent non-profits like Greenpeace and Amnesty International Canada have suffered targeted cyberattacks in recent years. Unlike major corporations with substantial cybersecurity budgets, non-profits operate with restrictive funding that limits their ability to invest in long-term digital resilience or attract experienced IT professionals.

Underreported and underprotected

Protect.ngo estimates over 1,000 publicly recorded cyberattacks have targeted non-profits globally since November 2018, with at least 22 in Canada. However, the true number is likely higher as many organizations choose not to report breaches to avoid damaging donor confidence and community trust.

The reluctance to acknowledge attacks stems from practical concerns. "There's no gain for them to report anything," Duguin explained. "If they report, donors are going to cut them loose." This underreporting creates a dangerous cycle where vulnerabilities remain hidden and unaddressed.

In 2024, the crisis prompted dozens of global humanitarian leaders to sign an open letter acknowledging: "We lack the resources and expertise to undertake the state-of-the-art cybersecurity measures that our mission requires."

Certification gap

One potential solution is the CyberSecure Canada federal certification program, which requires organizations to implement over a dozen security measures like multi-factor authentication and data encryption. However, only 58 small or medium organizations currently hold active certification, including just 19 non-profits certified by Complade.

Ian Ashor, managing director at Complade, argues that failing to evaluate cybersecurity should be treated as negligence. In the U.K., cybersecurity certification is mandatory for vendors that bid on certain government contracts, he noted, contrasting this with Canada's approach where only certain defense contractors face mandatory certification.

Neither the Canadian Crime Stoppers Association nor its local programs are CyberSecure-certified. Meanwhile, Professor Ali Dehghantanha of the University of Guelph warns that while certification is "better than nothing," it cannot replace regular independent assessments. "Any organization trusting a vendor with tipster identities should have obtained" SOC 2 compliance reports, he said.

Canadian non-profits are largely exempt from the Personal Information Protection and Electronic Documents Act that could enforce accountability for privacy breaches. Duguin suggests responsibility must also come from donors who should demand to see a cybersecurity strategy before supporting any NGO.