Cyber & Technology — 2026-06-04

UN World Food Programme Breach Exposes Personal Data of 600000 Gaza Households

BLUFAttribution to a state or state-affiliated actor remains very unlikely through end of 2026, leaving 600,000 households' location data exploitable by any party to the conflict without accountability.

WFP confirmed that unauthorized actors breached its self-registration application for Palestine on May 14, exposing names, ID numbers, phone numbers, and neighborhood location data from approximately 600,000 Palestinian households in Gaza The New Humanitarian" data-url="https://www.thenewhumanitarian.org/news/2026/06/02/data-600000-gaza-households-exposed-wfp-cyber-attack" data-rt="primary" data-otype="digital_news">123. The agency notified affected beneficiaries via Telegram on May 31 and suspended the platform pending security improvements, seventeen days after the intrusion occurred 12. The New Humanitarian, citing an anonymous whistleblower, reported that WFP's Rome headquarters received a warning about SRA vulnerabilities two days before the breach, told Palestine country team staff the flaw had been resolved, and that the intrusion occurred that same day 1. No party has claimed responsibility and WFP has not disclosed the attack vector 13.

Analysis
Location and identity data for 600,000 Palestinian households now sits with an unknown actor while Israeli courts compel humanitarian organizations to surrender staff rosters and Israeli forces have killed Palestinians at WFP distribution points. Attribution to a state or state-affiliated operator is very unlikely by December 31, 2026. An opportunistic criminal harvesting identity data for fraud fits the available evidence more parsimoniously. The 17-day notification gap constrained forensic reconstruction and the attack vector remains undisclosed. The New Humanitarian provided the sole original reporting, amplified by secondary outlets without independent sourcing. Moderate confidence rests on a consistent pattern of unattributed intrusions across UN humanitarian systems and WFP's narrow disclosure posture. Confirmed attribution would give donor governments a specific actor to hold accountable and a mandate to impose security requirements across humanitarian beneficiary registration systems.
4 sources
  1. Data of 600,000 Gaza households exposed in WFP cyber-attack - The New Humanitarian
  2. UN food agency discloses breach affecting 600,000 Gaza households - BleepingComputer
  3. UN food agency investigates breach exposing data of Gaza aid recipients - Recorded Future News
  4. WFP says cyberattack exposed data of 600,000 Gaza households - Middle East Eye

View in full brief →

UNCLASSIFIED // OPEN SOURCE