The Form 990 Hack You Need to Know About

By Raul Rivera

Pastor Stevens called me late one afternoon a couple of weeks ago concerned about his private information being compromised. When I asked him what the cause of his concern was, he informed me that he had received an email about a security breach for organizations that file Form 990-N (e-Postcard). Now, to give you a little background information, Pastor Stevens has an evangelistic ministry that we helped get incorporated in the state of North Carolina and approved as a 501(c)(3) religious nonprofit organization. In addition, we are assisting Pastor Stevens with the requirements for his ministry to file his ministry’s Form 990-N each year. Recognizing the panic that was beginning to pickup in his voice, I calmly and confidently informed him that neither he nor his ministry had anything to worry about.

The cause of his concern

The Urban Institute’s National Center for Charitable Statistics (NCCS) recently discovered that an unauthorized party or parties have accessed the Form 990 Online and e-Postcard filing systems for nonprofit organizations. In response, the NCCS sent an email out to all nonprofit organizations that have filed any type of Form 990. This unauthorized access affected nonprofit users of IRS Forms 990, 990-EZ, and 990-N (e-Postcard). In addition, it affected users of Form 8868 extensions and filings for charitable organizations in Hawaii, Michigan, and New York. Furthermore, the email notified the recipients that their username, first and last name, email address, IP address, phone number, and password associated with their nonprofit organization were compromised due to the incident. Although these forms do not contain Social Security numbers, credit card data, or individual tax filer information, it is highly advised that each organization change their password.

Where the potential problem lies

Though it is believed that no information from the filings themselves was compromised, the potential problem lies with the fact that passwords were compromised. Since most financial transactions today are completed online, individuals, oftentimes, tend to use the same password for multiple online accounts. For example, someone may use the same password for his or her email account as he/she uses for credit card accounts, bank accounts, and any social media accounts he or she has. The reason many people tend to do this is because it is easier to only have to remember one password than it is to remember numerous passwords.
The potential problem thus stems from the possibility that the individuals who operate these tax-exempt organizations (those required to file Form 990) may have used the same passwords when registering to e-file their Form 990’s as they used for other accounts. Not only is it highly suggested and encouraged for those organizations to change their password, but it is required that all organizations that registered to e-file prior to January 7, 2015 now change their password.

Putting Pastor Stevens’ worries to rest

Each year we have the privilege of serving hundreds of ministries and religious nonprofit organizations in completing their Form 990. Whenever this service requires us to create a password to e-file a Form 990, we create a password that is distinct and unique to each and every ministry. No password we create is ever the same.
After listening to Pastor Stevens’ concerns I was able to inform him of our standard to create unique passwords for each and every ministry that we serve. Upon hearing this, I could literally hear a sigh of relief come from Pastor Stevens. Unfortunately, we live in a day in time in which some people simply do not respect the privacy of other individuals. However, at StartCHURCH, your privacy and protection of personal information is of our utmost concern. It is simply our honor and privilege to have the opportunity to serve you and your ministries, and therefore, I would like to personally extend an invitation for you to come and join us at one of our Ultimate Church Structure Conferences. We would love the opportunity to meet you and hear your story.