Nearly half of UK charities have staff passwords in criminal credential collections — six in ten of the largest

Somebody walking down your street

That is exactly what this assessment does. Staff passwords circulating in criminal collections are the spare key under the mat — it does not mean anyone has used it, but somebody else knows where it is. A login page recorded alongside those passwords is knowing which door the key opens. A service reachable from the internet that need not be is the side gate nobody remembers leaving unlatched.

A stolen password is half an intrusion

A credential becomes far more useful to an attacker when the same criminal collection also records the page where it is used. That pairing is the single most actionable finding in this study — and it is not a subset. Every organisation with staff credentials exposed also has its internal login pages recorded alongside them: 65 of 65 in the best-known group, 99 of 99 by income. Where the key exists, so does the address.

In one case those pages included a jobs portal and a remote-desktop gateway — the kind of door that opens onto an internal network rather than a website.

A key on its own is of limited use to a stranger. A key with the address attached to it is a different matter.

The fix is unglamorous and it works: reset the credential, enforce multi-factor authentication, revoke the sessions that are already open.

Larger budgets did not remove the exposure

Both groups averaged the same external score of 65. Higher income did not translate into a visibly better external position — the differences are in the detail, and they run in both directions. The income group carries more credential exposure; the best-known group has more services answering from the internet. These are differences in exposure, not in competence.

The impersonation risk is the one charities feel

Charities depend unusually heavily on trust, and a convincing fraudulent email can exploit a charity's name even when the charity itself has not been breached. Around a third of each group does not tell receiving mail systems to reject forged messages.

Moving to an enforcing policy is low-cost, but it is not a switch to flip: identify the legitimate senders, monitor first, and only then move to rejection, so that genuine fundraising, CRM and supplier mail is not caught by it.

What we could not see

Standing in the street tells you nothing about the alarm system, the safe, or the locks on the internal doors. Many of these organisations will have good protections we simply cannot observe.

The full method, population and interpretation notes are on the method note.

Where to start

The full report sets out seven steps. The first three carry most of the benefit:

1. Check for exposed staff credentials and act on what you find — reset, enforce MFA, revoke live sessions, starting with identity providers, email, finance, CRM and remote access.
2. Enforce multi-factor authentication everywhere it matters — it removes most of the value of a stolen password.
3. Protect your name from forged email — move SPF, DKIM and DMARC towards an enforcing policy, after monitoring.

Steps four and five are about suppliers, and they are the ones a board can act on without any technical work at all: know what each material supplier holds for you, and make prompt, charity-specific incident information a contractual requirement. Supplier assurance cannot prevent a failure inside someone else's systems. What it can do is shorten your response.

The useful conclusion

It is not that charities are failing. It is that a large part of cyber resilience is made of small, manageable decisions — and that this sector starts from high public trust, committed people, and no visible sign of compromise across 380 organisations. It is a short list of things worth doing, and there is time in which to do them.