On January 20, 2022, the International Committee of the Red Cross (ICRC) disclosed that attackers had stolen sensitive personal data belonging to more than 515,000 vulnerable people across at least 60 Red Cross and Red Crescent societies. The records were held for the Restoring Family Links programme, which helps reconnect people separated by war, disaster, migration, and other crises. Exposed information included names, contact details, locations, and other identifying data, creating particular danger for people whose whereabouts or identities could make them targets.
The attackers compromised servers used by the ICRC, reportedly targeting a Swiss contractor that stored the information. According to the ICRC, an unpatched critical vulnerability in authentication software enabled the theft of administrator credentials, lateral movement through its systems, and data exfiltration. The organization characterized the operation as highly sophisticated and comparable in profile to state-sponsored attacks, but no perpetrator was identified and no direct attribution was established. There was no proof at the time that the stolen data had been publicly leaked. The ICRC suspended access to compromised systems, disrupting the family-reconnection service, and publicly appealed to the hackers to engage confidentially. The incident underscored how humanitarian databases can become high-value targets and how a single unpatched authentication flaw can threaten people already affected by crisis.
