Charity leaders failing to prioritise cyber security, government report warns

Charity leaders are falling behind their private sector counterparts in prioritising protection from cyber security risks, a government report has revealed.

While three quarters of senior managers in businesses consider cyber security a high priority, this proportion falls to less than two thirds among charity leaders.

The government’s latest cyber breaches survey has also found that only three in ten charities have trustees in place who are explicitly responsible for cyber security as part of their job role. This proportion rises to just under two thirds among boards of large businesses.

This survey was carried out over the winter of 2023/24 and involved more in depth responses gathered earlier this year.

It found that 32% of charities have experienced a breach over the last 12 months.

The most common form of attack is phishing, where fraudulent emails are set to entice people to reveal personal information, including bank details and passwords. This is impacting more than four in five charities.

More than one in seven charities have experienced attacks involving viruses or other forms of malware.

The average cost to charities of a breach was £460.

The Department for Science, Innovation and Technology, which has released the statistics, says that most charities have a “broad range” of cyber security measures in place.

This includes ensuring they are keeping malware protection up to date, restricting admin rights, having network firewalls set up and an agreed process for phishing emails.

But businesses are more likely than charities to take action to identify risks, the Department warns.

Just a quarter of charities have undertaken cyber security risks assessments, compared to three in ten businesses.

While a third of businesses have deployed security monitoring tools, this proportion dips to less than a quarter among charities.

In addition, just a third of charities are insured against cyber security risks, compared to four in ten businesses.

Last year it emerged that criminals posing as fundraisers diverted more than £2.7m away from charities last year. In the 12 months to October last year there were 501 charity crime fundraising fraud reports made.