Protecting the National Trust from Cyber Attacks: The Blackbaud Case Study

The Blackbaud data breach in 2020 underscored the critical importance of cyber security in the voluntary sector. Over 100 educational, charitable, and third-sector organisations, including several UK universities and the National Trust, were affected when cybercriminals breached Blackbaud’s systems, a company providing fundraising and administration software. The hackers demanded and received a ransom to delete stolen data, which included sensitive information about volunteers and supporters. Blackbaud’s delayed disclosure of the breach left many individuals vulnerable to further attacks. Join us at the Public Sector Cyber Security Conference to hear from The National Trust (Europe’s largest conservation charity) aswell as the NCSC, and more.

The Current Cyber Attack Threat on the Voluntary Sector

The current cyber threat to the voluntary sector in the UK remains significant, with a diverse range of threats facing these organisations. Recent reports indicate that approximately 14% of UK charities have experienced cybercrime in the past year, with the most common threat being phishing attacks (GOV.UK). These attacks often exploit human error, such as clicking on malicious links or using weak passwords, which continue to be a major vulnerability. Larger charities, particularly those with higher income levels, are more likely to face such threats due to their more extensive digital infrastructure and data holdings.

A major challenge for the voluntary sector is the varying levels of cyber security preparedness. While some high-income charities have formal cyber security strategies and incident response plans in place, many smaller organisations rely heavily on external contractors or digital service providers for their cyber security needs. This reliance often stems from a lack of in-house expertise, resources, or a dedicated cyber security budget. As a result, these organisations may not be fully equipped to handle sophisticated cyber threats like ransomware or distributed denial of service (DDoS) attacks​.

Moreover, there is a noted gap in awareness and adoption of government-endorsed cybersecurity standards among charities. Awareness of frameworks such as the National Cyber Security Centre’s (NCSC) Board Toolkit and the Cyber Essentials scheme remains low, particularly among smaller organisations. This lack of engagement with recognised cyber security practices further exposes the sector to potential attacks​.

The increasing reliance on digital tools and platforms in the voluntary sector, accelerated by the COVID-19 pandemic, has expanded the attack surface for cybercriminals. The adoption of advanced technologies like artificial intelligence (AI) and machine learning (ML) is being considered to bolster defences, particularly for threat detection, automated incident response, and phishing prevention. These technologies could play a crucial role in helping charities and voluntary organisations detect and respond to threats more proactively, potentially reducing the impact of cyber incidents.

The Blackbaud cyber attack was a significant data breach that affected many nonprofit and educational organizations globally, including the National Trust in the UK. Blackbaud, a US-based cloud computing provider for nonprofits, suffered a ransomware attack in early 2020. The hackers gained access to personal information stored in Blackbaud’s systems, which was used by the National Trust and other organizations to manage donor and supporter information.

For the National Trust, data potentially exposed in the breach included details such as names, contact information, and, in some cases, donor profiles and history. However, financial information, like credit card details or bank account numbers, was reportedly not compromised. After Blackbaud became aware of the breach, the company paid the ransom demanded by the attackers in exchange for assurances that the stolen data would be destroyed, though there was no guarantee of this.

Following the attack, the National Trust and Blackbaud informed affected individuals and took steps to enhance security. The incident raised awareness of the cybersecurity risks associated with cloud-based services and led to increased scrutiny of data protection practices in the nonprofit sector. The incident highlights the need for robust cybersecurity measures and timely communication to protect public trust and data integrity.

Cyber Security Solutions for the Voluntary Sector

To address the dynamic and evolving cyber threat landscape in the voluntary sector, several strategic solutions can be adopted to enhance cybersecurity resilience. Here are some key solutions:

Want to learn more? Fill in the form below

Protecting the Voluntary Sector From Dynamic Cyber Threats

The voluntary sector must continue to enhance its cyber resilience through better awareness, training, and adoption of comprehensive cyber security strategies to safeguard sensitive data and maintain public trust. Enhanced collaboration with government bodies, such as the NCSC, and investment in advanced cyber security technologies could be pivotal in addressing these evolving cyber threats.

The Blackbaud Case Study serves as a reminder of the severity of these cyber threats facing the voluntary sector. Join us at the Public Sector Cyber Security Conference to hear from the The National Trust aswell as the NCSC, and more. Please find out more below.

The Public Sector Cyber Security Conference 2025

Join us at The Public Sector Cyber Security Conference 2025 to receive the latest updates on the threat landscape. Discover the strategies and tactics required to successfully defend your organisation against attacks. Share experiences with your peers around the UK. Find the partners and solution providers you need to meet your challenges and stay secure.