A small Virginia nonprofit thought they were doing all the right things in terms of cybersecurity, cyber insurance and safety. They found out the hard way that it wasn’t enough to avoid the damage from a hacker that knew how to manipulate their weak points.