Text from the FAQ:
(1.41) Attacks against a character
An attack made against a character works the same as an attack made against a player with one exception: undefended damage from an attack against a character must be assigned to that character.
For example: Bilbo Baggins (OtD 1) has the most poison attached when Crazy Cob (OtD 29) is revealed from the encounter deck and its "When Revealed" effect triggers an attack against the character with the most poison attached. Even though the first player controls 3 other heroes, any undefended damage from this attack must be applied to Bilbo Baggins. Because Bilbo is already exhausted from committing to the quest, he cannot exhaust to defend himself and will be killed if the attack is undefended. Knowing this, the first player chooses to exhaust one of his ready characters, Bombur, to declare him as the defender for this attack. At this point, the attack resolves as normal and any damage from the attack is applied to Bombur.