Security Alert: NCCS Data Breach of Form 990 Online and e-Postcard Filing Systems
Urban Institute’s National Center for Charitable Statistics (NCCS) Alerts Users of Data Breach
Users of the Form 990 Online and e-Postcard Filing Systems received an email today from the Urban Institute’s National Center for Charitable Statistics (NCCS) informing its constituents of a data breach. AAFCPAs has confirmed that this email is legitimate; NCCS’ 990 websites were attacked.
An unauthorized party or parties have accessed the Form 990 Online and e-Postcard filing systems for nonprofit organizations. This unauthorized access affected nonprofit users of IRS Forms 990, 990-EZ, and 990-N (e-Postcard). In addition, it affected users of Form 8868 extensions and filings for charitable organizations in Hawaii, Michigan, and New York.
Usernames, first and last names, email addresses, IP addresses, phone numbers, and passwords associated with nonprofit user accounts were compromised in this incident.
At the time of this email, the NCCS believes that no information from the filings themselves was compromised. These forms do not contain Social Security numbers, credit card data, or individual tax filer information, so such sensitive information was not available to the hackers. Copies of the 990 returns, including the e-Postcard, are public documents that are released by the IRS.
What should you do?
If you use the same login credentials for your organization’s Form 990 Online and e-Postcard that you do for other websites or applications, you are strongly encouraged to change these passwords immediately in each of those instances, as well as on these systems.
To enhance security, all users accessing the Form 990 Online and e-Postcard systems are required to change their passwords upon logging in, or were when they logged in most recently. Please be alert for unusual or suspicious emails and use caution when clicking on links or opening attachments from unknown senders.
As always, you may also contact your Partner at AAFCPAs, or Robin Kelley at 774.512.4011, firstname.lastname@example.org.