Oxfam Australia has confirmed a data breach after a database belonging to the organization was leaked on an underground forum.
After being made aware of a suspected security incident by Bleeping Computer, the charity’s Australian arm has now confirmed that supporters of the charity have been impacted.
A threat actor was attempting to sell a database containing Oxfam Australia records on an underground forum and this information appears to have subsequently been leaked in February.
The records have been added to Have I Been Pwned, a search engine for users to see if their information has been leaked in data breaches. According to HIBP, 1.8 million unique email addresses, names, phone numbers, physical addresses, genders, and dates of birth were included — alongside partial credit card data in a small number of cases.
Donation histories may have also been exposed.
In a statement concerning the data breach, Oxfam Australia said a database was compromised on January 20, 2021, and the organization was made aware of the issue on January 27.
“The database includes information about supporters who may have signed a petition, taken part in a campaign, or made donations or purchases through our former shops,” the charity said.
The group, however, will not say exactly how many individuals have been affected.
Oxfam Australia has notified the Office of the Australian Information Commissioner (OAIC) and Australian Cyber Security Centre (ACSC). Impacted supporters will also be contacted.
No account passwords are thought to have been compromised and so the charity says it will “not be asking supporters to change their password.”
However, as is the case with any data breach, it is recommended that users do so anyway in the interest of their personal security. If the same password is in use elsewhere, these account credentials should also be changed.
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0
