Why Tasmania’s charities and community organisations are on attackers’ target lists, and what the regulator is now asking them to do about it.
Most of the organisations we work with in Tasmania exist to make money. Charities and community groups exist to give it away, or to spend what little they have on people who need help faster than they need a new firewall. That’s not a criticism of how they run. It’s the reality many of them work inside, and it’s exactly what makes them an appealing target.
The Attacker Doesn’t Care About the Cause
An organisation’s mission means nothing to the person trying to get into its donor database. What matters is what’s inside it: names, addresses, payment details, and sometimes health information if the charity supports people living with illness or disability. A food relief charity and a payment processor hold much the same kind of data, and criminals treat them the same way. The difference is that one of them usually has far less budget to defend it.
Charities run on tight margins by design. Every dollar spent on a security tool is a dollar not spent on a meal, a bed or a counselling session, and most boards make the understandable call to fund the mission first. It’s also why so many Tasmanian not-for-profits are running with basic gaps: no multi-factor authentication on the accounts that hold donor payment details, no documented plan for when something goes wrong, and little or no regular training for the staff and volunteers who are usually the first line of defence.
Volunteers Make the Attack Surface Bigger, Not Smaller
Most charities depend on volunteers who use their own laptops and phones to reach shared drives, donor lists and rosters, often rotating in and out faster than any onboarding or offboarding process can keep up with. That’s a very different risk to a conventional workplace with a fixed staff list, and a generic IT security checklist usually doesn’t account for it.
Picture a volunteer-run community organisation coming up to its annual appeal. A volunteer’s own laptop, used for both the donor system and their personal email, gets caught by a phishing email that has nothing to do with the charity. The attacker isn’t hunting for a charity. They’re harvesting whatever logins they can reuse. Because that laptop has sat logged into the donor platform for months without being asked to sign in again, the attacker gets a quiet run at the donor list, including saved payment details from recurring givers. The charity’s own website and email were never touched. It came in sideways, through a device nobody had thought to secure. This is a composite of the exposure we see across the sector, not one specific incident, but every element in it is common.
The Weak Point Is Often Someone Else’s System
A charity’s own systems aren’t always where the risk sits. A few years ago, a breach at a telemarketing provider used by dozens of Australian charities put donor records onto the dark web, and not one of those charities’ own systems was touched. The weakness sat two steps removed, with a vendor none of their supporters had heard of. If your organisation uses a fundraising platform, a CRM, a payroll bureau or an external call centre, that relationship is part of your security picture, whether anyone signed up for it that way or not.
The Regulator Has Noticed
The Australian Charities and Not-for-profits Commission updated its Cyber Security Governance Toolkit again this year, and the ask is more direct than before. It wants every registered charity to work through four things: know what data you hold and where, put basic controls in place to prevent and limit damage, manage the people and third parties who touch your data, and have a plan for when, not if, something happens.
Larger organisations have usually met this kind of expectation by adopting a formal framework such as the Essential Eight. For most small Tasmanian not-for-profits, that’s a bigger step than is needed right now. The regulator singles out multi-factor authentication on email and donor systems as the highest-value step for an organisation with limited time and budget.
The Pritech Approach
At Pritech, we help Tasmanian charities and community organisations work out what they hold, who touches it, and which of the ACNC’s steps to take first. For most, that starts with multi-factor authentication on email and donor systems.
If your organisation is due for a check, get in touch with our team today.
