A suspected account compromise calls for prompt, coordinated action. The priorities are to limit harm, preserve useful evidence, obtain technical support, and understand which people and systems may be affected. Avoid improvising a response across multiple staff members without a clear coordinator.

Contact your incident lead through a safe channel

Tell the designated incident lead and IT or security provider through a channel you believe is safe. If email may be compromised, use a verified alternative. Record when the problem was noticed, what was observed, and which accounts or devices may be involved. Treat unexpected payment or credential requests as unverified until checked through a separate trusted channel.

Do not send passwords, recovery codes, or private account information to someone who offers unsolicited help. Use known provider contacts and official recovery channels. If a device may be compromised, seek advice from a trusted specialist about containment and using a clean device for recovery.

Work with a technical responder

Work with the account provider or responder on recovery, securing authentication, and reviewing unauthorized access, active sessions, recovery settings, forwarding rules, and connected applications. The appropriate order depends on the incident. Preserve relevant logs and messages where possible; avoid wiping devices or deleting evidence without specialist direction.

Check whether the account has access to other systems or sensitive data. Ask finance staff to verify any affected payment instructions through established contacts. Involve counsel and your insurer where appropriate to assess contractual, reporting, and notification obligations. Do not assume that recovering a password means the incident is resolved.

Contact nonprofit-focused support

Access Now’s Digital Security Helpline provides round-the-clock technical assistance to eligible civil society users. Follow its current eligibility and contact instructions, and describe the issue briefly without sending credentials. Its work is focused on digital security.

The Builders provides nonprofit cybersecurity support through a program involving volunteer expertise and tools. Confirm current eligibility, available incident help, and timing directly. It should not be assumed to provide immediate response to every incident.

The Democracy Protection Network is another pathway for eligible organizations seeking cybersecurity assistance. Explain the urgency and existing response contacts. Applying for support does not replace activating your own provider or meeting applicable deadlines.

Communicate findings and review the response

Maintain an incident timeline, action owners, and a record of technical findings. Coordinate any staff, donor, participant, or public notices with counsel and the responder. State what is confirmed, what is being investigated, and when further information will be available; avoid premature claims about exposure or resolution.

After containment and recovery, review the cause, access controls, backups, training, and the response plan. Assign follow-up actions and test the improvements. Specific technical steps and legal obligations require qualified advice based on the incident.

Explore the Nonprofit & Foundation Resilience guide for related resources. For strategic or crisis communications support, contact Caitlin at CBKStrategies.

Back to all resilience resources · Home · About CBKStrategies

Back to all resilience resources