"No-one will target us" is empirically wrong.
Pareto Phone exposed supporter data from charities that trusted a shared fundraising vendor. The ICRC had data on more than 515,000 vulnerable people compromised. ACNC Governance Standard 5 places a duty of reasonable care and diligence on responsible persons, with ACNC enforcement powers behind it. ASD describes charities and not-for-profits as prime targets for cybercriminals.
Why Not-for-Profits are in the crosshairs
Five shifts shaping the Not-for-Profit threat environment — why "no-one will target us" is empirically wrong, and why the regulatory floor is rising.
The "we're too small to be a target" assumption is empirically wrong
ASD describes charities and not-for-profits as prime targets for cybercriminals, and the ACNC's own guidance is plain: charities, even smaller ones, can be targeted too. Infoxchange's 2025 survey found 14% of not-for-profits had experienced a cyber breach in the past 12 months. Pareto Phone and the ICRC are the headline cases.
Third-party and fundraising-vendor risk is the dominant cascade pattern
Pareto Phone was a shared telemarketing vendor with more than 70 charity clients. Its 2023 breach exposed supporter data from charities including Amnesty International Australia, the Australian Conservation Foundation, MSF and WWF-Australia. Charity operations depend on outsourced fundraising agencies, donor-management CRMs, payment processors and email providers, and each vendor holding supporter data is a potential cascade point. The ACNC's 2024–25 compliance focus asks how charities ensure third parties manage risk on their behalf.
Data retention is a primary risk multiplier
Some of the data exposed in the Pareto Phone breach was historical: MSF said its exposure was data from 2012 to 2015, and the Australian Conservation Foundation said it was concerned Pareto kept old data it should have destroyed. The OAIC has since updated its guidance for not-for-profits, and has said that "the indefinite retention of personal information is simply not justifiable from a good privacy practice perspective". Many charities' own systems carry the same pattern: legacy donor databases, volunteer records, event registration histories and grant application data.
Beneficiary data sensitivity creates safety risk, not just reputational risk
The ICRC breach compromised data on people separated from their families by conflict, missing persons and people in detention. Australian charities working with domestic violence survivors, refugees, people experiencing homelessness or minors hold data whose exposure creates immediate safety risk. Director-General Mardini's appeal to the attackers — "do not share, sell, leak or otherwise use this data" — captures what is at stake when this class of data is exposed.
The regulatory floor is rising, and responsible persons carry personal exposure
ACNC Governance Standard 5 requires responsible persons to act with reasonable care and diligence, and the ACNC's cyber security guidance places ultimate responsibility for cyber risk with a charity's responsible people. Where a charity fails its obligations the ACNC can issue warnings and directions, accept enforceable undertakings, seek injunctions, and suspend or remove responsible persons. Mandatory ransomware payment reporting (from 30 May 2025, for entities with turnover over $3 million), the Privacy Act's Notifiable Data Breaches scheme and ASD's March 2024 guidance for charities set the direction of travel.
What regulators and experts are saying
Those who run charities have an obligation to ensure good governance is in place to minimise the risks, and to be prepared to act quickly and effectively if an incident did occur.
The people who run a charity are ultimately responsible for managing cyber security risks.
An attack on the data of people who are missing makes the anguish and suffering for families even more difficult to endure. We are all appalled and perplexed that this humanitarian information would be targeted and compromised. This cyber-attack puts vulnerable people, those already in need of humanitarian services, at further risk.
Cyber security is an ACNC compliance focus, and ransomware payment reporting is live
The ACNC named cyber security a compliance and enforcement focus for 2024–25, including how charities ensure third parties manage risk on their behalf. Mandatory ransomware payment reporting under the Cyber Security Act 2024 has applied since 30 May 2025 to entities carrying on business in Australia with annual turnover over $3 million; Home Affairs notes not-for-profits are not explicitly exempt.
The NFP and charities regulatory stack is principles-based rather than prescriptive. ACNC Governance Standards apply to registered charities (Basic Religious Charities are exempt from the Governance Standards, though other obligations still apply). Governance Standard 3 requires charities to comply with Australian laws. Governance Standard 5 requires responsible persons to act with reasonable care and diligence, and the ACNC's cyber security guidance places ultimate responsibility for cyber risk with a charity's responsible people. The Privacy Act applies to NFPs with annual turnover over $3 million, and regardless of turnover to NFPs that provide health services, trade in personal information or provide services under a Commonwealth contract. The Cyber Security Act 2024's mandatory ransomware payment reporting has applied since 30 May 2025 to entities carrying on business in Australia with turnover over $3 million; Home Affairs notes NFPs are not explicitly exempt. ASD's March 2024 cyber security advice for charities and NFPs sets a practical baseline. The Essential Eight is not mandatory for NFPs, but gives a structured maturity model for the same practices. Charities operating overseas must also meet the ACNC External Conduct Standards. Sector-specific regulation (aged care, NDIS, child safety, health services) compounds where applicable.
Source: ACNC — 2024–25 compliance focus (20 March 2024)
Applies to NFPs with annual turnover over $3 million, and regardless of turnover to NFPs that provide health services, trade in personal information or provide services under a Commonwealth contract. APP 11 is the direct cyber hook — reasonable steps to protect personal information.
Not mandatory for NFPs, but ASD's baseline set of mitigation strategies, covering practices ASD's charities advice recommends (multi-factor authentication, prompt updates, backups). ML1 is a common starting target; ML2 where a funder or customer requires it.
Mandatory 72-hour ransomware payment reporting for entities carrying on business in Australia with turnover over $3 million. Home Affairs notes not-for-profits are not explicitly exempt.
Where NodeZero applies
An internationally recognised information security management certification, relevant to large NFPs and to the fundraising and donor-management platforms that hold charity supporter data.
Where NodeZero applies
Relevant to fundraising agencies, donor-management CRMs, payment processors and grants management platforms that handle Australian charities' supporter data.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
ACNC Governance Standard 5 and cyber security
2024–2025 focusGovernance Standard 5 requires responsible persons to act with reasonable care and diligence. The ACNC's cyber security guidance places ultimate responsibility for cyber risk with a charity's responsible people, and suggests seeking outside help where no-one in the charity has enough knowledge and experience. The ACNC made cyber security a compliance and enforcement focus for 2024–25, and published the findings of its Cyber Security Risks review in July 2025. Where a charity fails its obligations, ACNC powers include directions, enforceable undertakings, and suspending or removing responsible persons.
Source: ACNC Governance Toolkit — Cyber securityCyber Security Act 2024 — mandatory ransomware payment reporting
30 May 2025Entities carrying on business in Australia with annual turnover over $3 million must report ransomware payments to ASD within 72 hours. Home Affairs notes not-for-profit organisations are not explicitly exempt. The Act also establishes a Cyber Incident Review Board for no-fault reviews of significant incidents, and limited use provisions that restrict how reported information can be used and disclosed.
Source: Home Affairs — Ransomware payment reporting factsheetPrivacy Act APP 11 — reasonable steps and NDB
OngoingAPP 11 requires organisations to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. Eligible data breaches likely to result in serious harm must be notified to the OAIC and affected individuals. Applies to not-for-profits with annual turnover over $3 million (income from all sources), and regardless of turnover to health service providers, organisations trading in personal information, and contractors providing services under a Commonwealth contract.
Source: OAIC — Small business and the Privacy ActASD — Cyber security for charities and not-for-profits
Mar 2024Non-binding advice from the Australian Signals Directorate addressed to charities and not-for-profits, with a cyber security checklist. Released March 2024. Its top tips include turning on multi-factor authentication, installing updates as soon as possible, backing up and testing backups, reviewing access controls often, and testing detection and incident response plans. A practical baseline you can measure your charity against.
Source: ASD / ACSCAttack-based evidence, sized for charity IT.
NodeZero shows your Board what an attacker could actually reach, so directors can oversee cyber risk without becoming cyber specialists.
Find your organisation
See how the changes affect you specifically
Large charities
Charities with annual revenue of $3M or more — the ACNC's "large" tier. Above $3 million in annual turnover the Privacy Act's small business exemption no longer applies and ransomware payment reporting can apply, on top of the ACNC Governance Standards.
View details →Fundraising agencies & donor platforms
Fundraising agencies, donor-management CRMs, payment processors, and grants platforms — the vendor layer charities are now asked to oversee after Pareto.
View details →International humanitarian
Australian-headquartered humanitarian and international development organisations — ICRC-benchmark sensitivity, overseas operational risk, and ACNC External Conduct Standards on top of the standard stack.
View details →Why security teams trust NodeZero
References
Everything cited on this page — regulator reports, incident coverage, and official framework documentation.
Give your Board evidence for its GS5 cyber oversight
See what an attacker could reach in your charity's environment