When Paul Nichol first heard about the Crime Stoppers data breach, one thought immediately crossed his mind: “Holy crap, this happens every day.”
“It was a real wake-up call for me. It was like, ‘Oh yeah … this could happen to us,'” he told CBC News.
Nichol, who is from rural Brussels, Ont., manages one of the 267 offices of Community Futures, a national non-profit network that loans money to and advises local entrepreneurs.
“We do collect an enormous amount of data,” like names, addresses and social insurance numbers, he said.
His organization fends off three or four phishing attempts a week, easily — in his experience, they are “very, very common.”
“There’s always that little dark cloud behind you saying, ‘Is today the day we’re going to get hacked?'”
Cybersecurity experts interviewed by CBC News say the Crime Stoppers data breach, which exposed information linked to more than 1.5 million tips sent to Canadian chapters of the non-for-profit organization over 25 years, was not an outlier but rather one example of a worldwide threat.
While most Canadians don’t think of data breaches when they donate to a non-profit, experts warn they can gather datasets just as massive and sensitive as any commercial bank. But unlike a major bank, they lack the resources to defend themselves against increasingly sophisticated cyber attacks — and when these groups are breached, they often stay silent to protect donor confidence and community trust.
“Non-profits are targeted by everyone,” said Stéphane Duguin, CEO of the Geneva-based Protect.ngo Foundation, in an interview with CBC News.
More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds
Duguin said non-profit organizations are more at risk because in addition to common attacks like email phishing attempts, they can also fall victim to targeted, politically motivated hacks, due to the nature of their work. That can look like cyber-attacks backed by wealthy states or state-backed criminal groups, meant to disrupt on-the-ground activities or destroy credibility.
Even larger organizations with more resources have not been spared, with major non-profits like Greenpeace and Amnesty International Canada having suffered targeted cyberattacks in recent years. If anything, their prominent profile makes them more appealing to groups that want to silence them, says Duguin.
“You attack them so that people are not going to trust them anymore…. What you attack is their reputation.”
And when hackers attack, NGOs often struggle to defend themselves because of their restrictive funding and lack of IT expertise.
Stéphane Dugui is the CEO of the Geneva-based Protect.ngo Foundation. (Submitted by Stéphane Duguin)
“When your funding mechanism becomes more and more project-based, it’s extremely difficult as an organization to maintain a strategy when it comes to your digital resilience,” said Duguin, whose organization helps non-profits prevent and recover from cyberattacks.
Most not-for-profits receive funding and grants for specific projects, limiting their ability to invest in a long-term cybersecurity strategy and to attract experienced IT professionals.
“They would not access the talent,” said Duguin. “There’s too much competition. So they will not be competitive when it comes to salary and retention.”
The crisis even prompted dozens of global humanitarian leaders to sign an open letter in 2024 pleading for support.
Federal privacy commissioner investigating Crime Stoppers data breach
“We lack the resources and expertise to undertake the state-of-the-art cybersecurity measures that our mission requires,” reads the open letter.
Many non-profits also share the reluctance of private companies to publicly acknowledge cyber attacks.
Protect.ngo estimates there have been more than 1,000 publicly recorded cyber attacks targeting non-profits around the world since November 2018 — at least 22 of which are Canada-based — but Duguin says the true total is likely higher.
“There’s no gain for them to report anything,” Duguin said. “If they report, donors are going to cut them loose.”
One potential solution for non-profits is to complete the CyberSecure Canada federal certification program, said Ian Ashor, managing director at Complade, one of several accredited certification bodies.
The certification, developed by Innovation, Science and Economic Development Canada, is valid for two years, and requires organizations to implement over a dozen security measures, like multi-factor authentication and encrypting their data.
Ashor argues that failing to evaluate cybersecurity measures should be treated with the same severity as hiring an unaccredited accountant.
“It’s negligence at this point.”
Ian Ashor is the managing director of Complade, one of several accredited certification bodies for the CyberSecure Canada program. (Submitted by Ian Ashor)
He says that in the U.K., cybersecurity certification is mandatory for vendors — including non-profits — that bid on certain government contracts involving personal information. But in Canada, only certain defence contractors are subject to their own mandatory certification.
As a result, Ashor says, only 58 small or medium organizations currently hold an active CyberSecure Canada certification, including the 19 non-profits certified by Complade.
For context, the Canada Revenue Agency’s website currently reports over 85,000 organizations registered as charities in Canada.
Neither the Canadian Crime Stoppers Association (CCSA) nor any of its local programs are CyberSecure-certified.
More Canadian Crime Stoppers chapters pause program after CBC investigation | Hanomansing Live
But Nichol’s Community Futures program is. He went through the process at the request of FedDev Ontario, the federal agency that funds his non-profit’s Southern Ontario offices. It also came with one-time funding to hire an accreditation company.
“It wasn’t pleasant, but it was very useful.… We checked every app, every platform, from every supplier, vendor.”
Crime Stoppers had ‘potentially one of the most harmful data breaches’ Canada has seen. What’s next?
He told CBC the process — which was completed with Ashor’s Complade — demanded hundreds of hours for staff and volunteers, but it was “absolutely worth it.”
Nichol added that the certification process included a checklist of detailed questions for the third-party company that manages his non-profit’s data. That checklist, along with other resources, is free to download online.
It is unclear if the CCSA ever asked similar questions of Navigate360, the third-party vendor that managed its data, and was the target of the March hack that leaked Crime Stoppers’ tips.
The U.S. company’s promotional documentation states it “maintains annual SOC 2 Type 2 Security Compliance.” Unlike a CyberSecure Canada certification, which is pass or fail, this yearly confidential report evalutes a company’s cybersecurity measures — one that Ali Dehghantanha, a cybersecurity expert, stresses “any organization trusting a vendor with tipster identities should have obtained.”
Canadian privacy watchdogs powerless to hold Crime Stoppers accountable for data breach
CBC has asked Navigate360 and the CCSA if they held active cybersecurity certifications and whether SOC 2 reports were shared. Neither has responded.
A certification like CyberSecure is “better than nothing,” said Dehghantanha, the Canada Research Chair in Cybersecurity at the University of Guelph, but it cannot replace regular, independent assessments by experts.
Professor Ali Dehghantanha is one of two cybersecurity experts who examined samples of the leaked Crime Stoppers data. (Li Yanjun/CBC)
In any case, Canadian non-profits are largely exempt from the Personal Information Protection and Electronic Documents Act that could force accountability for privacy breaches.
That accountability must also come from donors and philanthropists, said Duguin, who should demand to see a cybersecurity strategy before sharing their data — and their money — with any NGO.
“Responsible donorship should be around making sure that your grantee is secure,” he said. “We and others are providing this for free for non-profits; there’s no excuse not to do it.”
