The ICRC lost data on 515,000 vulnerable people. The tradecraft was APT-grade.
As an Australian-headquartered international humanitarian or development organisation — Red Cross Australia, World Vision, Save the Children, MSF, Oxfam, Plan International, Caritas, Act for Peace, ChildFund — you hold some of the most sensitive beneficiary data any non-government organisation holds. The 2022 ICRC breach of 515,000 records is your international benchmark. CISA's May 2025 advisory on Russian state-sponsored targeting of Western logistics firms coordinating aid deliveries to Ukraine makes it clear aid-delivery operations are in state-actor scope. You also meet ACNC External Conduct Standards on top of the standard Australian regulatory stack.
Your specific challenges
ICRC-class beneficiary data
People separated from families by conflict, missing persons, people in detention, refugees, survivors of gender-based violence. Exposure creates direct physical safety risk — not reputational harm recoverable with a statement.
State-actor scope is real, not theoretical
The ICRC's own analysis indicated APT-grade tradecraft. CISA's May 2025 advisory confirmed Russian state-sponsored targeting of logistics firms coordinating aid deliveries to Ukraine. Humanitarian organisations holding politically sensitive data sit inside both opportunistic-criminal and nation-state threat classes simultaneously.
External Conduct Standards layer on top
For Australian charities operating overseas, ACNC ECS adds overseas-specific risk assessment obligations. Cybersecurity risks particular to local operating environments must be explicitly considered.
Built for your situation
Edge authentication validation (ICRC pattern)
The ICRC was compromised via an unpatched Zoho ManageEngine module (CVE-2021-40539). Rapid Response and External Pentesting specifically test for this class of edge authentication vulnerability.
Humanitarian-data reach assessment
Segmentation and internal testing reveal how concentration of beneficiary data is actually protected — or not — from a compromised user, vendor, or field office. The sensitivity demands evidence beyond documented policy.
Continuous validation for long-dwell-time risk
The ICRC took 70 days to detect its breach, and industry dwell times routinely run into months. NFPs typically lack 24/7 SOC capability. Continuous NodeZero validation proactively reduces exploitable attack paths without requiring continuous monitoring capability.
Protect the data humanitarian work depends on
Book an international humanitarian baseline against the ICRC-pattern edge authentication and beneficiary-data concentration risks