The ICRC had data on 515,000 vulnerable people compromised. The ICRC linked it to advanced persistent threat tools.
As an Australian-headquartered international humanitarian or development organisation, you hold some of the most sensitive beneficiary data any non-government organisation holds. The ICRC breach, which compromised data on more than 515,000 people, is your international benchmark; the ICRC said the attackers used tools primarily used by advanced persistent threat groups. A May 2025 joint advisory co-authored by ASD's ACSC warned of Russian GRU targeting of logistics and technology organisations involved in delivering foreign assistance to Ukraine. You also meet the ACNC External Conduct Standards on top of the standard Australian regulatory stack.
Your specific challenges
ICRC-class beneficiary data
People separated from families by conflict, missing persons, people in detention, refugees, survivors of gender-based violence. Exposure creates direct physical safety risk — not reputational harm recoverable with a statement.
State-actor scope is real, not theoretical
The ICRC said its attackers used tools primarily used by advanced persistent threat groups. A May 2025 joint advisory (CISA, ASD's ACSC and partners) described Russian GRU targeting of logistics and technology organisations involved in coordinating and delivering foreign assistance to Ukraine. Organisations holding politically sensitive data sit inside both criminal and nation-state threat classes.
External Conduct Standards layer on top
For Australian charities operating overseas, the ACNC External Conduct Standards add obligations on overseas activities and control of resources, anti-fraud and anti-corruption, and protection of vulnerable individuals.
Built for your situation
Edge authentication validation (ICRC pattern)
The ICRC was compromised via an unpatched authentication module (CVE-2021-40539). Rapid Response runs targeted exploit tests for newly disclosed vulnerabilities of that kind, and External pentesting shows what is exploitable at your perimeter.
Humanitarian-data reach assessment
Segmentation and internal testing reveal how concentrations of beneficiary data are actually protected — or not — from a compromised user account or field office network. The sensitivity demands evidence beyond documented policy.
Regular validation for long-dwell-time risk
The ICRC's attackers were inside for 70 days before detection. Running NodeZero regularly finds and closes exploitable attack paths between tests, without needing a 24/7 SOC to run it.
Protect the data humanitarian work depends on
See your exposure to edge authentication attacks and beneficiary-data concentration