A data breach at a church or small nonprofit rarely looks like the dramatic hacking scenes people picture. More often, it’s a staff member noticing an unfamiliar login alert, a donor reporting an odd charge after giving online, or an email account that starts sending messages nobody wrote. What happens in the first day after that discovery has a real effect on how the situation resolves.

The first step is containment, not investigation: change passwords on the affected account and any account that shares that password, enable multi-factor authentication if it isn’t already active, and if a device seems compromised, disconnect it from the network rather than trying to diagnose the problem yourself. Speed matters more than certainty here — it’s better to lock things down and sort out the details afterward than to spend hours investigating while the exposure continues.

Next, document what you know and don’t know, even in rough form: what account or system was affected, roughly when you noticed it, and what data might have been accessible — donor payment information, congregant contact details, staff records. This doesn’t need to be a polished report; it’s raw material that your insurance carrier and, if needed, a forensic investigator will use to scope the actual incident.

Call your insurance agent or carrier promptly if you have cyber coverage, since many cyber policies provide access to breach response resources — forensic investigators, legal counsel, notification services — that are far more effective when engaged early rather than after an organization has already tried to handle everything internally. If notification of affected individuals turns out to be legally required, timing requirements can be strict, which is another reason early reporting to your carrier matters.

Action Items

• Change passwords and enable MFA on the affected account(s) immediately upon discovery.
• Write down what you know so far (account, timing, likely data exposed) before calling anyone.

This post is for general informational purposes only and isn’t legal or insurance advice — breach response requirements vary by situation, so please talk with a licensed insurance professional and an attorney promptly if you believe a data breach has occurred.