Following a “major” cyber-attack on a huge database held by the International Committee of the Red Cross (ICRC), the Australian Red Cross is contacting clients and assessing its local systems and services. The database contained case file information on over 500,000 people from all over the globe who had requested assistance for loved ones gone missing, were detained in immigration detention or were unable to contact due to tragedy or conflict.
‘Restoring family links’ (RFL) is a term used by Red Cross and Red Crescent national organizations across the world to describe these activities. According to a recent Australian Red Cross statement, a range of personal details and given paperwork “may have been put into the database.”
“This is a standard internal process to ensure that information is kept in one place, and we can communicate with our partners in other countries when trying to find a missing loved one,” Australian Red Cross stated in an advisory.
This information might include names, contact information, info about the circumstances of a missing loved one, the names and contact information of any relatives shared with the Red Cross, or information about the conditions of detention and the concerns made with them. It also comprises all documentation supplied to the Red Cross throughout the case’s management, such as identification documents, intake forms, ICRC Attestation of Detention certificates, Red Cross Messages sent between family members, and images.
Australian Red Cross revealed that there was “no indication” that the information was “deleted or tampered with,” leaked or abused. However, it was revealed that hackers had gained access to the system and could copy and export information. One of the challenges the Australian Red Cross faces in determining the degree of local exposure to the incident is that it no longer has access to the database. Its ability to deliver humanitarian aid is also being harmed due to this.
The Australian Red Cross is also conducting an independent evaluation of local systems and services to ensure that they remain safe. The ICRC claimed in a statement last week that the attack targeted a data storage provider that stored data from at least 60 Red Cross and Red Crescent National Societies throughout the world.
Meanwhile, Robert Mardini, director-general of the International Committee of the Red Cross, asked the attackers not to release the information.
