Keeping donor data safe when you don't have an IT department

Five habits to start with

• Turn on two-factor authentication everywhere it's offered, starting with email. It adds a second step after your password, like a code sent to your phone. The federal cybersecurity agency, CISA, says users who turn it on are "significantly less likely to get hacked."
• Use a password manager so every account has a strong, unique password. Reused passwords turn one leak into many.
• Limit who can see what. Not every volunteer needs the full donor list. Give people access to only what their role needs.
• Keep your tools updated. In Verizon's 2026 breach report, security holes were the top way in, at 31% of breaches. Updates patch known holes, so don't put them off.
• Learn to spot phishing. Phishing is a fake message that tricks you into clicking a link or sharing a password. It comes by email, and more and more by text or phone call (Verizon, 2026). When in doubt, don't click. Check with the sender another way, like a number you already have.

Why this matters for a small team

It's not personal. Small orgs hold real data: names, emails, giving history, sometimes payment details. And there may be no one whose job is security. In 2020, ransomware hit Blackbaud, a company that sells donor database tools to nonprofits. The attack affected more than 13,000 of its customers (SEC, 2023). Those customers were hit because their vendor was. The FTC says the attacker got in with one customer's login and password. It also says that turning on two-factor login for every employee and customer, one of several steps it lists, would likely have prevented the breach or at least made it smaller (FTC, 2024). So the tools you pick matter as much as your own habits.

Choose tools that protect you

Where donor data lives matters. Look for sign-in that's hard to steal, like two-factor login. Some tools skip the password and email you a sign-in link instead. Then your email is the key, so two-factor on your email guards that tool too. Look for limits on who sees what, and a way to export your data anytime. Ask how the tool protects stored data, including encryption. Pick one that answers plainly.

Have a simple "what if" plan

1. Know what you hold and where

   You can't protect data you've forgotten is in an old spreadsheet.

2. Keep backups

   Ransomware is far less scary when you have a clean copy.

3. Know who you'd tell

   Every state has a law that can require you to tell people when their personal information leaks (FTC, 2023). Know your state's rule before you need it.

None of this needs an IT team. Turn on two-factor, use unique passwords, limit access, install updates, and pause before you click. That closes the easy ways in. Calm and prepared beats worried and exposed.