WFP Gaza Data Breach Exposes 600,000 UN Food Agency Household Records
Published
Key Takeaways
- Data Breach Scale: World Food Programme said a data breach exposed sensitive information belonging to about 600,000 Palestinian households in Gaza.
- Platform Suspended: WFP temporarily suspended the Self-Registration Application while investigating the breach, which occurred on May 14.
- Attribution Unknown: WFP has not identified who may have been behind the intrusion or confirmed whether any data was leaked.
The World Food Programme (WFP) is investigating a security incident that compromised personal information submitted by Palestinians seeking humanitarian assistance in Gaza. In a message sent to aid recipients via Telegram, WFP said "unauthorized parties" had accessed data stored in its self-registration application in Gaza, where individuals register for food and cash assistance after completing a verification process.
What Data Was Exposed
In a statement to The New Humanitarian, a WFP spokesperson said the incident exposed sensitive information belonging to approximately 600,000 Palestinian households in Gaza. The data breach occurred on May 14 and was limited to the Self-Registration Application (SRA) used exclusively in Palestine.
The exposed information included:
- names,
- identification numbers,
- phone numbers,
- location details (including neighborhood information collected at registration).
WFP temporarily suspended the registration platform while its investigation is ongoing. The spokesperson said the agency took immediate action to shut down the platform, contain the intrusion, and strengthen security controls to prevent further exposure.
WFP has not publicly identified who may have been behind the intrusion or disclosed how access was gained. It is also not yet clear whether any of the compromised information was leaked or further distributed.
Context: WFP's Role in Gaza
WFP is the world's largest humanitarian organization focused on combating hunger and food insecurity. The agency says it provides food parcels, hot meals, bread, and cash assistance to approximately 1.6 million people in Gaza each month, making the security of its registration data particularly consequential for a highly vulnerable population.
In early 2026, the Pro-Palestine hacktivist group Mr. Hamza claimed an MI6 DDoS attack. In mid-2024, Arid Viper deployed spyware in Egypt and Palestine.
In other recent news, DentaQuest exposed over 2.5 million accounts in ShinyHunters extortion attack, and an Ultrahuman data breach exposed wellness data via an internal analytics tool.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular