# WannaCry and ransomware: how to keep your charity safe

- Link: https://fundraising.co.uk/2017/05/15/wannacry-ransomware-keep-charity-safe/
- Published: 2017-05-15T18:19:41+01:00
- Author: Howard Lake

**Following the global damage wrought by the WannaCry ransomware attack, the Charity
Commission has published an alert advising how charities can be protected from the
threat.**

 

In issuing its [regulatory advice](https://www.gov.uk/government/news/ransomware-threat-keep-your-charity-safe)
under section 15(2) of the Charities Act 2011, the Commission acknowledges that 
charities could also be at risk from this attack. It urges charity staff and trustees
to be vigilant.

## Advertisement

 [⌊Posthub advert. You create the campaign. We'll handle the postal journey. Get started at post-hub.co.uk.⌉](https://fundraising.co.uk/ads/posthub-20261007-300x250/)

 

Specifically, the Commission, the independent regulator for charities in England
and Wales, advises all charities to follow protection advice recently issued by 
the City of London Police and National Cyber Security Centre (NCSC).

 

## What to do

 

The key protection messages from the Charity Commission are:

 

 * Install system updates on all devices as soon as they become available
 * Install anti-virus software on all devices and keep it updated
 * Create regular backups of your important/business critical files to a device 
   that is not left connected to your network, as any malware infection could be
   spread to that too
 * Do not meet any stated demands and pay a ransom – this may be requested via digital
   cryptocurrency Bitcoin

 

For technical guidance, including specific software patches, the Commission recommends
charities consult the [National Cyber Security Centre](https://www.ncsc.gov.uk/guidance).
The site also contains in-depth technical guidance on how to protect an organisation
from ransomware.

 

## Phishing and smishing

 

The Commission goes on to advise that other fraudsters might attempt to exploit 
this incident by targeting charities via phishing or smishing (SMS phishing) campaigns.

 

It therefore advises charities to be cautious if they receive any unsolicited communications
from the NHS. [The NHS is one of the organisations most affected by the WannaCry ransomware attack](http://www.bbc.co.uk/news/technology-39917278)
in the UK, although organisations and individuals in over 150 countries have also
been affected.

 

In this regard the Commission advises charities:

 

 * Any email address can be spoofed. Do not open attachments or click on the links
   within any unsolicited emails you receive, and never respond to emails that ask
   for personal/charity information or financial details
 * The sender’s name and number in a text message can be spoofed, so even if the
   message appears to be from an organisation you know of, continue to exercise 
   caution, particularly if the texts are asking you to click on a link or call 
   a number.

 

## How charities should report cyber-attacks

 

Staff and trustees who think that their charity has been compromised or affected
by a cyber-attack should report it to [Action Fraud](http://www.actionfraud.police.uk)
by calling 0300 123 2040. 

 

Trustees are advised also to report suspected or known fraud incidents [to the Charity Commission](https://fundraising.co.uk/2017/05/15/wannacry-ransomware-keep-charity-safe/RS*@***********************ov.uk).

 

Serious incident reporting helps it gauge the volume and impact of incidents within
charities and to understand the risks facing the sector as a whole.

 

Harvey Grenville, Head of Investigations and Enforcement at the Charity Commission
said: “Charities need to be aware of the imminent danger posed by ransomware threats
and take appropriate steps to protect their charity from cyber-attack – a charity’s
valuable assets and good reputation can be put at risk from these dangerous scams.

 

“I urge all charities, if they suspect they may have fallen victim to cyber fraud,
to report it immediately to Action Fraud and to the Commission, under its [serious incident reporting](https://www.gov.uk/guidance/how-to-report-a-serious-incident-in-your-charity)
regime.”

 

Charities can also visit [Charities Against Fraud](http://www.charitiesagainstfraud.org.uk)
for advice and tips on protection against cyber-fraud.

 * **[How Bitcoin is changing the face of non-profits](https://fundraising.co.uk/2015/01/09/bitcoin-changing-face-non-profits/)**(
   9 January 2015)
 * **[New Bitcoin donation handbook for nonprofits](https://fundraising.co.uk/2015/02/05/new-bitcoin-donation-handbook-for-nonprofits/)**(
   5 February 2015)
 * **[Unicef introduces charitable cryptocurrency Unicoin](https://fundraising.co.uk/2015/07/13/unicef-introduces-charitable-cryptocurrency-unicoin/)**(
   13 July 2015)

![Loading](https://fundraising.co.uk/wp-content/plugins/page-views-count/ajax-loader-
2x.gif)