“We’re too small to be a target” is one of the most common — and most mistaken — assumptions in nonprofit cybersecurity. In reality, small organizations are often more attractive targets than large ones, precisely because they’re less likely to have dedicated IT security staff, formal training, or modern email protections, while still holding valuable data: donor payment information, congregant records, and staff personal data.

The most common cyber incident small nonprofits actually face isn’t a dramatic ransomware attack — it’s business email compromise, where a scammer gains access to or spoofs a staff email account and requests a wire transfer or gift card purchase that looks like it’s coming from a pastor, executive director, or board member. These schemes work specifically because nonprofit culture tends to be trusting and informal, which is exactly what makes the sector a comparatively soft target.

Cyber insurance doesn’t prevent these incidents, but it addresses the financial fallout: the cost of forensic investigation, notifying affected donors or congregants if their data was exposed, credit monitoring where required, legal costs, and in some cases the stolen funds themselves depending on the policy. For an organization operating on donation-funded budgets, a cyber incident without insurance can mean an unplanned expense large enough to affect programming for a full year.

Coverage is typically inexpensive relative to the risk it addresses, especially for organizations with modest technology footprints. The more important step, honestly, is simply having the conversation with an agent about what your specific data exposure looks like — how you process donations, what member or congregant data you store, and whether email protections like multi-factor authentication are in place — since that shapes both the right coverage and the underwriting questions a carrier will ask.

Action Items

• Set an internal rule: no wire transfer or payment change without phone verification.

This post is for general informational purposes only and isn’t legal or insurance advice — every organization’s data exposure is different, so please talk with a licensed insurance professional about what cyber coverage fits your situation.