WFP data hack leaves 600,000 Gaza aid recipients ‘vulnerable to Israeli targeting’

 ROME - The World Food Program (WFP) has confirmed a massive data breach it suffered last month exposed the sensitive information of 600,000 Gazan households who had signed up to receive food aid, according to the UN agency's official channels.

 The breach, first reported by the New Humanitarian, included names, mobile numbers, and location data, and is potentially the largest known hack of a humanitarian organisation in history.

 Human rights organisations have expressed concern the information could be used for targeting by Israel, which has been accused of systematically attacking aid operations in the devastated enclave.

 "This concern is not abstract,” warned Palestinian digital rights organisation 7amleh, “Palestinians seeking aid have been killed, and the occupying power has pressed humanitarian organisations to hand over the personal data of those connected to aid operations in Gaza.”

 Israel has killed more than 560 aid workers in Gaza since 2023, according to the UN figures, with thousands of famine-stricken civilians also reported to have been killed by Israeli forces while seeking aid at distribution sites.

 “[The people of Gaza’s] trust has now been broken twice: once by those who would weaponise this data, and once by the system that failed to safeguard it" continued 7amleh, criticising the WFP’s seemingly bungled response to the crisis.

 A cybersecurity expert had warned the Palestine WFP branch about the vulnerability two days before the breach, according to a whistleblower who spoke with the New Humanitarian.

 The warning was then relayed up to WFP headquarters in Rome, where the cybersecurity team claimed the issue had been resolved on May 14, only to suffer the massive data breach that same day.

 Despite being aware of the incident, the WFP took over two weeks to inform affected Gazans that their sensitive information had been exposed, posting a brief message on its official Gaza Telegram channel on May 31.

 The WFPs internal guide on how to respond to data breaches calls on staff to “take all appropriate and feasible measures to ensure beneficiaries’ safety,” recognising that breaches in confidentiality can “have dire consequences for individual beneficiaries or beneficiary communities, ranging from abuse and ostracization to death.”

 The incident is likely to lead to renewed scrutiny of data practices at the WFP, which handles information on beneficiaries from some of the world’s most vulnerable populations.

 The UN agency has come under criticism from Amnesty International in recent years for its partnership with surveillance data giant Palantir.

 The Trump-adjacent company has a cooperation agreement with the Israeli Ministry of Defense, and has been accused by the Business and Human Rights Centre of facilitating Israel’s AI-based strike targeting in the Gaza Strip, though there is no suggestion it was involved in the latest data breach.

 The affair could also heighten the impression the agency has been rudderless since former Executive Director Cindy McCain, who officially left the organisation this week, announced late last year she was stepping down due to suffering a stroke.