netiCRM management breach triggers nonprofit checks as donor database copying is confirmed

A breach at a donation-software provider has put servers serving more than 500 nonprofit organizations into an inspection and rebuilding process. On November 12, Citizen Congress Watch identified a concrete consequence: its donation database had been copied, according to an updated investigation supplied by vendor Netivism. The organization temporarily closed its online donation page while existing recurring donations continued.

The compromised machine was the provider’s internal management server, rather than a single customer’s netiCRM application server, iThome reported. A useful analogy is a building manager’s office containing keys to several properties. Separate premises can still share an operational point of failure. The 500-plus figure describes the scope of checks and rebuilding, not a confirmed count of organizations whose donor records were stolen.

Taiwan AI Academy’s notice describes an intrusion early on November 9 using an internal account and a system vulnerability. Its November 13 update lists stolen vendor-held customer information, support records, management code and parameters, internal keys, and donor information belonging to one affected organization. The academy said that, as of November 10, it had not received notification that its own personal data had been stolen. Its students’ card information is held by a separate payment provider.

Citizen Congress Watch’s November 12 statement identifies the organization’s own donor database as having been copied. Potentially exposed fields include names, contact details, addresses and donation histories. It also described attacks involving staff email and management accounts after the intruder obtained administrative access. Separately stored credit-card information was outside the exposure described in its statement. Vendor customer records and a nonprofit’s donor database are distinct sets of information, even when the same incident puts both at risk.

Recovery can itself interrupt services. According to iThome, the provider isolated systems, replaced exposed keys and worked on mail servers and administrative accounts, while customer-server rebuilding could temporarily interrupt websites and netiCRM access. For donors, the immediate concern is a convincing impersonation using genuine personal details. Citizen Congress Watch warned about supposed duplicate charges, refund requests and donation-setting problems. It does not ask donors to operate an ATM to obtain a refund. Independently locating an organization’s contact channel offers a safer way to check such a message than following the contact details supplied by its sender.

Original source dates: Citizen Congress Watch, November 12, 2026; iThome, November 12, updated November 13; Taiwan AI Academy, November 11, updated November 13, 2026.