CIVIL SOCIETY / CASE-STUDY COLLECTION
Protect the mission.
Learn from experience.
Cybersecurity case studies for NGOs and civil society organisations.
A lost campaign account. Repeated phishing. A server held to ransom. Real accounts of disruption can help a team ask better questions before its own incident.
WHY THIS COLLECTION
Security decisions reach beyond IT.
For a civil society organisation, digital systems support relationships with supporters, colleagues, and the people it serves. A disruption can interrupt that work even when the first sign looks like a problem with a single account.
The Solidarity Action Network’s Solidarity Playbook, developed with the CyberPeace Institute, brings together four cybersecurity case studies. They offer first-hand experience from civil society, alongside lessons and guidance for staff across departments.
READ THIS WITH YOUR TEAM
- Choose a case close to one of your own dependencies.
- Discuss the decisions people had to make, as well as the technical response.
- Agree one improvement with an owner and a review date.
THE READING FILE
Four incidents.
Four useful conversations.
These short descriptions signpost the published cases. The questions are CyberSolace prompts for your own team, rather than findings about the organisations involved.
01
When a campaign account is taken over.
UICC’s case concerns a phishing attack on its World Cancer Day Instagram account.
Discuss: who can recover a critical account if its usual administrator cannot get in?
02
When phishing keeps returning.
Transparency International’s case describes a sustained email-phishing campaign over six weeks.
Discuss: how would staff report repeated suspicious messages, and how would you coordinate a response?
03
When access is repeatedly tested.
A humanitarian organisation describes a sophisticated brute-force and phishing attack.
Discuss: who would notice unusual sign-in activity, and who has authority to act?
04
When a server becomes unavailable.
A global non-profit describes an attack that held its data hostage.
Discuss: which services need restoring first, and when did you last test that recovery?
TURN READING INTO A DECISION
Bring one dependency
to the next team meeting.
Choose something your work relies on: a campaign account, a shared mailbox, a donor system, or a case-management service. Ask the people who use it what would happen if it stopped working today.
Make the discussion concrete.
Record who owns the service, who can recover access, how to reach the provider, and where staff should report a concern. Check that those arrangements still work when the normal email account is unavailable.
Keep sensitive operational details in your organisation’s own records. Use a no-blame discussion to find gaps in the arrangements, rather than faults in individual colleagues.
READ FURTHER
The cases are the starting point.
Lessons across the collection
Read the publisher’s synthesis of the challenges and opportunities raised by the four incidents.
Guidance for civil society professionals
Use SANE’s guidance to continue a broader discussion about protecting the organisation online.
Make resilience part of the mission.
If the discussion exposes unclear responsibilities or untested recovery arrangements, CyberSolace can help you plan a proportionate next step.
ATTRIBUTION & REVIEW
Case studies and guidance: Solidarity Action Network / International Civil Society Centre, in partnership with the CyberPeace Institute. Browse the collection. The incidents are historical examples, not a measure of current threat frequency. The discussion prompts above are general guidance and should be adapted to your organisation.
Originally published 23 April 2023. Presentation and resource links reviewed 20 October 2026.