Phase 1: Reconnaissance — gathering information about the foundation
The attacker begins with reconnaissance using public sources. They analyze the foundation’s website, identifying staff, partners, and grant-making institutions. They check public registries for board member data. They search social media for information about current projects and events. They scan the domain for missing SPF/DKIM/DMARC records, which would enable email spoofing. This entire reconnaissance takes the attacker a few hours and uses exclusively publicly available information.
Phase 2: Attack — phishing and account takeover
Based on gathered intelligence, the attacker crafts a personalized phishing email. The message looks like a notification from a grant platform the foundation works with. It states that login is required to confirm data for grant settlement — the deadline is 24 hours away. The link leads to a fake login page that is a copy of the real portal. The staff member responsible for grants, under time pressure, enters their credentials. The attacker immediately logs into the real account, changes the password, and creates an email forwarding rule.
Phase 3: Data exfiltration and extortion
The attacker exports the donor database from the CRM — names, addresses, emails, donation histories, and payment data. They download financial documentation, reports, and grant agreements. Then they encrypt accessible systems with ransomware and leave a ransom demand. The foundation loses access to email, CRM, documents, and financial systems. Simultaneously, the attacker threatens to publish donor data — double extortion.
How to break the attack chain — defense at every stage
At the reconnaissance stage: limit publicly available information, configure DMARC. At the phishing stage: train staff to recognize fake messages, deploy MFA on all accounts — even after entering a password, the attacker cannot gain access without the second factor. At the account takeover stage: monitor unusual logins, restrict permissions. At the exfiltration stage: prevent bulk data export without admin approval, maintain offline backups enabling system restoration without paying ransom. nFlo offers security audits that identify gaps at every link of this chain.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Why this matters for organizations
How does a typical cyberattack on a foundation unfold? A step-by-step analysis — from reconnaissance through breach to donor data exfiltration — and how to defend. In the context of growing cyber threats and tightening regulations (NIS2, DORA), organizations must proactively manage this security area. Failure to implement adequate safeguards can lead to data breaches, financial penalties, and reputational damage.
Best practices for implementation
Effective implementation requires several key steps:
- Risk assessment and inventory — identify assets, threats, and vulnerabilities specific to your organization.
- Policy development — document requirements, roles, and responsibilities.
- Technical controls — deploy tools and configurations proportionate to identified risks.
- Training and awareness — engage employees in protecting organizational security.
- Monitoring and continuous improvement — regularly verify effectiveness and adapt to the evolving threat landscape.
Related terms
Related services and products
- IT System and Infrastructure Configuration Review
- Physical Security Assessment
- CrowdStrike Falcon OverWatch
