Phase 1: Reconnaissance — gathering information about the foundation
The attacker begins with reconnaissance using public sources. They analyze the foundation’s website, identifying staff, partners, and grant-making institutions. They check public registries for board member data. They search social media for information about current projects and events. They scan the domain for missing SPF/DKIM/DMARC records, which would enable email spoofing. This entire reconnaissance takes the attacker a few hours and uses exclusively publicly available information.
Phase 2: Attack — phishing and account takeover
Based on gathered intelligence, the attacker crafts a personalized phishing email. The message looks like a notification from a grant platform the foundation works with. It states that login is required to confirm data for grant settlement — the deadline is 24 hours away. The link leads to a fake login page that is a copy of the real portal. The staff member responsible for grants, under time pressure, enters their credentials. The attacker immediately logs into the real account, changes the password, and creates an email forwarding rule.
Phase 3: Data exfiltration and extortion
The attacker exports the donor database from the CRM — names, addresses, emails, donation histories, and payment data. They download financial documentation, reports, and grant agreements. Then they encrypt accessible systems with ransomware and leave a ransom demand. The foundation loses access to email, CRM, documents, and financial systems. Simultaneously, the attacker threatens to publish donor data — double extortion.
How to break the attack chain — defense at every stage
At the reconnaissance stage: limit publicly available information, configure DMARC. At the phishing stage: train staff to recognize fake messages, deploy MFA on all accounts — even after entering a password, the attacker cannot gain access without the second factor. At the account takeover stage: monitor unusual logins, restrict permissions. At the exfiltration stage: prevent bulk data export without admin approval, maintain offline backups enabling system restoration without paying ransom. nFlo offers security audits that identify gaps at every link of this chain.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Why this matters for organizations
How does a typical cyberattack on a foundation unfold? A step-by-step analysis — from reconnaissance through breach to donor data exfiltration — and how to defend. In the context of growing cyber threats and tightening regulations (NIS2, DORA), organizations must proactively manage this security area. Failure to implement adequate safeguards can lead to data breaches, financial penalties, and reputational damage.
Best practices for implementation
Effective implementation requires several key steps:
- Risk assessment and inventory — identify assets, threats, and vulnerabilities specific to your organization.
- Policy development — document requirements, roles, and responsibilities.
- Technical controls — deploy tools and configurations proportionate to identified risks.
- Training and awareness — engage employees in protecting organizational security.
- Monitoring and continuous improvement — regularly verify effectiveness and adapt to the evolving threat landscape.
Related terms
Related services and products
- IT System and Infrastructure Configuration Review
- Physical Security Assessment
- CrowdStrike Falcon OverWatch
Frequently asked questions
Is this attack scenario realistic?
Yes — this is a typical attack progression against a nonprofit organization. Variants of this scenario have affected organizations including the International Committee of the Red Cross and many smaller organizations.
Which single safeguard would stop the attack fastest?
MFA on the email account — even after capturing the password, the attacker could not log in. This single safeguard breaks the entire attack chain at Phase 2.
How much does recovery from such an attack cost?
For a mid-size foundation, costs include: system restoration, legal handling of GDPR breach, crisis communication and donor loss (difficult to estimate). Prevention costs a fraction of this amount.
