Cyberattacks on Funder Creates Secondary Harms for Grantees

By Michelle Ferrier, Ph.D.

Recent hacks and threats of the website of Borealis Philanthropy has forced the U.S.-based organization to scrub the website of all identifying data, including staff names, grantees and project information. Borealis manages a portfolio of funds focused on LGBTQIA, people of color and solutions for diverse communities.

“When you go to the site now, there’s no information,” said Tracie Powell, program officer for the racial equity and journalism fund. “We had to pull it down and take everything off the website.” The Fund for Black Lives Movement was also targeted in the attacks.

Borealis experienced phishing schemes against their staff and DDos attacks on the website through July and August 2020, believed to originate from right-wing extremists. Grantee data was scraped from the site and grantees were also targeted in the cyberattacks, a secondary target of the cyberattacks.

Powell described the frustrations of trying to manage the funds this fall without the website.

“It’s hurting our ability to get the word out about the funds and the work that our grantees are doing,” Powell said. Powell said other funders look to Borealis to identify potential grantees.

“People want to know who our grantees are,” she said. “The White funders don’t know who the news organizations of color are and they see who we are funding.”

Journalists and organizations that do work or reporting in and with communities of color have been the repeated target of attacks thorough the election season in the United States. Nonprofits and other organizations should armor their communications in a few ways:

1. Minimize the exposure of staff and grantees by limiting identifying data of individuals. Replace staff communications with generic business emails for incoming inquiries.
2. Mirror your website on a different platform. Use Tumblr, WordPress or another content site as a front door so that hackers cannot take down both sites.
3. Create alternative communication channels for grantees and other stakeholders.
4. Be discerning about the type of information that you disclose about grantees, sources, and other potential secondary targets of your work.

Borealis Philanthropy is now rebuilding their communications strategies with the assistance of digital security personnel, Powell said. “We are working on security now and ways to communicate, but yeah.”