Most charities no longer hold their most sensitive data on their own computers. Donor records sit in a cloud CRM, client notes in a case management platform, medication charts in a clinical system, and payroll with an outsourced provider. That arrangement is usually safer than a server in the office cupboard, but it creates a risk boards rarely discuss: what happens when the supplier is the one that gets hacked.
The National Cyber Security Centre's Cyber Threat Report 2026, released on 24 September 2026, makes that question hard to ignore.
What the NCSC Reported
The full report covers the year to June 2026. The NCSC received 4,673 incident reports, and $23.8 million in direct financial loss was reported to it. It handled 369 incidents of potential national significance, 162 of which were linked to criminal or financially motivated actors, an 18 percent increase on the previous year. Four incidents were classified as highly significant, which the NCSC says matches the number recorded over the previous ten years combined.
One of the report's judgements is devoted to digital supply chains. It says supplier compromises have caused major incidents over the past year, and explains why attackers favour them: one compromised vendor can give access to many client organisations. It also notes that many suppliers are based overseas and that organisations here often have little visibility of their security settings.
Three Incidents Worth Knowing
The report describes several incidents that show how supplier compromises reach organisations that did nothing wrong themselves.
In February 2026 a medication management platform used across the health and care sector was hacked. According to the NCSC, attackers altered some patient records, and operations were disrupted at many aged care facilities, hospices and community pharmacies while the system was offline.
In late December 2025 an attacker used a valid user's credentials, stolen by information-stealing malware, to access a widely used patient portal. The NCSC reports that sensitive information for more than 99,000 patients was taken, and that the Ministry of Health concluded the breach was largely preventable, citing weaknesses including multi-factor authentication that was not mandatory.
In May 2026 a breach of a US-owned cloud learning management system affected more than thirty tertiary institutions, schools and education suppliers, with the Ministry of Education estimating 110,000 to 120,000 students and staff affected. Any charity that runs training, tutoring or education programmes on a third-party platform faces the same structural risk.
Your Privacy Act Obligations Do Not Transfer
The most important point for boards is legal rather than technical. The Office of the Privacy Commissioner's guidance on which agency reports a privacy breach says an organisation that uses another organisation to handle a task on its behalf, such as storing data or running a mail-out, "remains responsible for reporting any privacy breaches". The guidance adds that the contract with the provider should require the provider to tell the organisation about any breach, and that section 11 of the Privacy Act 2020 determines whether one or both organisations are treated as holding the information.
The Commissioner applied that principle after the patient portal incident. Its notice to primary care providers explains that providers using third-party platforms are generally responsible for reporting serious breaches under section 114, but that in that case the platform's own notification satisfied the requirement and individual providers did not need to notify separately. That was a specific decision about one incident. A charity should not assume the same outcome when its own supplier is breached.
In practice, the charity that collected the information is likely to be the one its clients, donors and funders hold responsible, regardless of where the breach occurred.
Questions to Ask Your Suppliers
The NCSC report recommends that organisations assess suppliers' cyber security as part of procurement, write specific data protection and security expectations into contracts, get ongoing assurance that suppliers maintain them, and plan and exercise a response to a breach involving a third-party application. For a charity, that translates into a short set of questions for each supplier that holds personal information.
- Where is our data stored, and who can access it?
- Is multi-factor authentication enforced for every user, including our staff and volunteers?
- How quickly will you tell us if our data may have been accessed, and is that commitment in the contract?
- What happens to our data if we end the contract or you cease trading?
- What does the contract say about your liability to us if a breach on your side causes us loss?
The last question often has an uncomfortable answer. Software terms often cap the supplier's liability, which can mean the cost of responding to a supplier breach may fall largely on the charity.
Where Cyber Insurance Fits
Cyber policies differ considerably in how they treat incidents that start at a supplier, and this is one of the most important areas to check before renewal.
Breach response cover, which funds forensic investigation, legal advice on notification, and communication with affected people, may respond where the charity's own data is compromised on a supplier's system, but some wordings require the incident to occur on systems the insured owns or controls. Business interruption cover is similar. Loss caused by a supplier's outage is often treated as dependent or contingent business interruption, which may be excluded, sub-limited or limited to named providers.
The charity cyber insurance page explains how cyber cover sits alongside crime and trustee liability policies. For supplier risk specifically, ask whether the policy responds to a breach of your data held by a third party, whether dependent business interruption is included and at what limit, and whether the insurer's incident response panel can work with an affected supplier.
A Short Checklist for the Board
List every external platform that holds personal information about donors, clients, staff or volunteers. For each one, note what data it holds, whether multi-factor authentication is enforced, and what the contract says about breach notification. Make sure the charity's incident response plan includes a scenario where the supplier, not the charity, is breached. Then take the list to your insurance review and confirm how the cyber policy responds to each platform.
Registered charities that have just completed a governance review under the Charities Act 2005 may find supplier oversight was not covered. It is a reasonable item to add at the next board meeting.
Get Your Cyber Cover Reviewed
charityinsurance.co.nz passes enquiries to Registered Financial Service Providers who place cyber cover for not-for-profit organisations and can explain how a policy treats incidents at your suppliers. Get a Quote and a specialist will be in touch within one business day.
Sources: NCSC Cyber Threat Report 2026; Office of the Privacy Commissioner. All checked 10 October 2026.
About the Author
The CharityInsurance Crew — the CharityInsurance crew are your friendly insurance geeks on a mission to make specialist cover simple and accessible for every NZ charity, sports club, and community organisation.