Your trust matters to us. We want to help you understand what happened and what you can do. A cybersecurity incident at a law firm exposed records that The Great Commission Foundation (The GC) had shared with its lawyers. The incident did not occur within The GC’s systems. We understand this news can be unsettling. Below, you can find out who is affected, what support is available and how to contact us.
What happened. This year, the Canada Revenue Agency (CRA) asked The GC for certain records. Registered charities must provide these records to CRA when asked. We hired a law firm to help us respond and shared files with these lawyers for review and advice. On October 25, 2026, the law firm told us about a cybersecurity attack it had discovered on October 22, 2026. Criminals used deception, known as social engineering, to gain access to four individual accounts and client files at the law firm. On October 28, 2026, the law firm confirmed that the affected files included records we had shared for advice on responding to the CRA. The law firm has told us it has stopped the attack, secured the data and is working with law enforcement and other experts to further protect client data.
The law firm was one of several prominent Canadian law firms targeted in a coordinated attack.
Who is affected. Information about The GC’s internal Canadian projects, employees and donors from 2023 and/or 2024 was accessed without authorization. Banking, credit card and account information was not exposed. U.S. partners, employees and donors are not affected. External charity clients that use The GC’s donation processing and other financial services, and their donors, are also not affected.
How we are supporting you. We are contacting affected projects, individuals and donors directly to explain what information was exposed and help them decide what steps to take. Most were notified by email from November 3 to 5, 2026. If you were a project representative, donor or employee, or more than one of these, in 2023 or 2024, you may have received more than one notification. We sent a separate notice for each type of affected information. Those we could not reach by email will receive notice by mail shortly.
We are meeting our regulatory and reporting requirements, including required notifications to privacy commissions, our financial institutions, insurers and other regulatory bodies.
We have been continually reviewing and strengthening our systems, processes and security measures in recent years and as part of previously planned investments. We also have advanced verification for our vendor payment accounts.
How The GC protects your information. We take protecting your information seriously. The GC protects staff accounts with multi-factor authentication and conditional access sign-in rules, uses a managed password vault, monitors laptops and servers with endpoint detection and response software, and requires a VPN on public networks. To further protect sensitive information within GC systems, The GC’s internal ERP uses role-based security roles, to protect select data types.
Steps you can take. First, read your notification to see what information was affected and what support is available. If you think your personal information may be affected, consider placing a free fraud alert on your credit file with Equifax and TransUnion. Monitor your bank and credit card statements for unusual activity. Report signs of fraud to your local police service.
Watch for unexpected messages. We will never ask for your full card number, banking details, PIN or passwords by email, text or an unexpected phone call. If a message that appears to come from us seems unusual, do not click links or reply. Call us using the phone numbers below to check whether it came from us.
If you have not received a notice. If you did not receive a notice, you are likely not affected by this incident. If you cannot find a notice and believe you may be affected, check your spam or junk folder and grouped email conversations. If you still cannot find a notice and wish to check whether you are affected, call our office or contact your ministry advisor or our donations team using the contact details below.
We are here to answer your questions. We understand you may want to know more about how this affects you. We know you likely have a lot of questions, and we understand this news can be unsettling. As part of our response to this incident, we have set up an inquiry management process, so every question can be tracked and answered with the diligence it deserves. We will be pleased to receive your inquiry and share as much information as we can.
Please leave one message or send one email so our team can track your request and respond. We are receiving many inquiries and appreciate your patience as we give each one careful attention.
Who to contact. To protect privacy, we cannot share details about the law firm, other organizations or individuals, or whether they are affected. Please use the contact details below.
Projects and project payroll or contract wage employees: contact your ministry advisor
Donors, qualified donees, foundations and donor advised funds (DAFs):
GC-Canada: donations-ca@thegc.org
GC-U.S.: donations-us@thegc.org
Media: media@thegc.org
All other inquiries:
GC-Canada: 1-855-488-7020 or info@thegc.org
GC-U.S.: 1-855-573-8483 or info-us@thegc.org
Do you have questions or want more information about The Great Commission Foundation or our projects?
Contact us - we’d love to help!
Since 2002, The Great Commission Foundation has enabled ministry projects to thrive by providing charity admin expertise and guidance while promoting collaboration in fulfilling the Great Commission. We are registered with the Canada Revenue Agency for charitable work (charity number: 85992 8483 RR0001).
US