When a nonprofit’s data ends up somewhere it shouldn’t, there usually wasn’t an attacker involved. A folder was set to “anyone with the link,” shared in an email thread two years ago, forwarded, and never looked at again.
That’s the ordinary version of a data breach in this sector, and it doesn’t feel like one while it’s happening. It feels like quickly giving a new volunteer access to the files.
How it happens
Cloud storage makes sharing effortless, which is mostly a good thing. But every share setting stays exactly as it was left. The link created for a grant reviewer in 2023 still works. The intern who left last spring is still on the program folder. The board packet shared with “anyone who has the link” can be opened by anyone the email was forwarded to, and anyone they forwarded it to.
Nobody did anything wrong at the time. The problem is that nobody went back.
Three habits that fix most of it
- Share with named people, not with links. It takes twenty seconds longer, and it means you can see exactly who has access later.
- Put an expiration date on the links that genuinely have to exist. A link for a one-week project should not still work in 2029. Most file-sharing tools let you set this when you create the link.
- Review your most sensitive folders on a schedule. Once a quarter, open the donor folder, the finance folder, and the client folder, and read the access list. You will almost certainly find someone who left.
Two key rules for files
A link can be revoked. An attachment can’t. The spreadsheet you emailed to nine people now lives in nine inboxes permanently, outside anything you control. Send a link instead, to named people, and you can take it back. For anything with donor or client details in it, always send a link.
Don’t create shadow copies. Exporting a donor list to a personal laptop to work on at home feels harmless. But copying data to a personal device creates unmanaged copies that don’t get revoked, don’t get backed up properly, and don’t get deleted when the person leaves.
When someone leaves
Offboarding is where share links matter most. When a staff member or volunteer leaves:
- Remove their access to shared folders on their last day.
- Transfer ownership of the files they created before closing their account, so nothing disappears with it.
- Check whether they shared anything outward with links, and disable those.
Start with the folder that matters most
You don’t need to audit everything at once. Start with the one folder that would hurt most if it were exposed, which for most nonprofits is the donor data or the client records. Fix that one, then work outward.
This week’s action
Open the folder holding your donor data and look at exactly who it’s shared with. Check whether any link is set to “anyone.”
Next in this section: know which rules you’re already under.