Security Alert: NCCS Data Breach of Form 990 Online and e-Postcard Filing Systems

Posted on

Urban Institute’s National Center for Charitable Statistics (NCCS) Alerts Users of Data Breach

Users of the Form 990 Online and e-Postcard Filing Systems received an email today from the Urban Institute’s National Center for Charitable Statistics (NCCS) informing its constituents of a data breach.  AAFCPAs has confirmed that this email is legitimate; NCCS’ 990 websites were attacked.
An unauthorized party or parties have accessed the Form 990 Online and e-Postcard filing systems for nonprofit organizations. This unauthorized access affected nonprofit users of IRS Forms 990, 990-EZ, and 990-N (e-Postcard). In addition, it affected users of Form 8868 extensions and filings for charitable organizations in Hawaii, Michigan, and New York.
Usernames, first and last names, email addresses, IP addresses, phone numbers, and passwords associated with nonprofit user accounts were compromised in this incident.
At the time of this email, the NCCS believes that no information from the filings themselves was compromised. These forms do not contain Social Security numbers, credit card data, or individual tax filer information, so such sensitive information was not available to the hackers. Copies of the 990 returns, including the e-Postcard, are public documents that are released by the IRS.

What should you do?

If you use the same login credentials for your organization’s Form 990 Online and e-Postcard that you do for other websites or applications, you are strongly encouraged to change these passwords immediately in each of those instances, as well as on these systems.
To enhance security, all users accessing the Form 990 Online and e-Postcard systems are required to change their passwords upon logging in, or were when they logged in most recently.  Please be alert for unusual or suspicious emails and use caution when clicking on links or opening attachments from unknown senders.
As always, you may also contact your Partner at AAFCPAs, or Robin Kelley at 774.512.4011, rkelley@nullaafcpa.com.


About the Author

Robin Kelley

Robin D. Kelley, CPA, CGMA, CITP, CSPM, CCSFP

Robin brings a wealth of experience to AAFCPAs’ clients in the areas of System & Organization Control (SOC) Reporting, Agreed-Upon Procedures, and special attestations. Robin has specialized expertise performing quality control reviews of user entity SOC reports, including SOC 1 (SSAE 18), SOC 2, SOC 2+ and 3 attestation reporting. She has extensive experience developing SOC reports for service organizations and has a deep understanding of internal controls from a design, implementation, and testing perspective. This allows …