Charity Donors’ Information Exposed on Dark Web: A Breach of Thousands of Records

Thousands of Australian charity donors have fallen victim to cyber-attacks after their personal details were published on the dark web.

In April, cyber criminals hacked Brisbane-based telemarketer Pareto Phone which provides services to more than 70 Australian charities.

These includes some of the country’s largest charities including the Cancer Council, the Fred Hollows Foundation, and Canteen have been affected by the data breach.

The personal information leaked to the dark web included phone numbers and email addresses of thousands of Australians.

In a statement, the Fred Follows Foundation said although it had ended the relationship with Pareto Phone for nine years, the telemarketer still kept the private details of 1,700 of its donors.

The charity said it was “deeply disappointed” by the incident.

“We worked with Pareto Phone only during 2013 and 2014. We were not aware our data was still held by them,” they said in a statement, according to the Institute of Community Directors Australia.

“Under the Australian Privacy Principles, there is a requirement for personal information data to be destroyed or de-identified once it is no longer needed for the purpose for which it was collected,” it continued.

“This is a requirement all our partners must comply with. We have requested pareto. Phone delete any remaining data on our donors.”

Canteen, which provides help for young people struggling with cancer, said the breach had affected 2,600 of its donors whose personal details including name, data of birth, address, email and phone numbers were leaked.

However, the charity had assured that no financial information had been leaked.

“It has taken some significant time to understand exactly what personal information about a subset of Canteen supporters has in fact been accessed,” a spokesperson told ABC.

“We’re deeply upset that our supporters have been impacted by a data breach at Pareto Phone a company contracted by Canteen, and we have paused all activity with them,” he added.

“We understand that this will cause major concern for kind-hearted people who donate to support the 23,000 young people dealing with the immense challenges of cancer every year.”

Cancer Council confirmed the incident occurred saying it had cut ties with the telemarketer.

Cancer Council Australia CEO Professor Tanya Buchanan said the charity took its donors’ privacy seriously.

“We understand that this may be a concerning situation for anyone who has generously donated to Cancer Council, and we unreservedly apologise for any distress caused.”

In a statement on Wednesday morning, Médecins Sans Frontières (MSF) said its partnership with Pareto Phone had ended in 2018.

“Under the Australian Privacy Principles, organisations must take reasonable steps to destroy personal information data that is no longer required,” the group said.

“MSF has not worked with Pareto Phone for almost five years.”

According to ABC, Pareto Phone CEO Chris Smedley has apologised for the issue and said it was cooperating with forensic specialists to analyse affected files.

“We have not at this stage identified any identity documents such as tax file numbers, driver licenses and passports about any donor,” Mr. Smedley said.

Pareto Phone has reported the matter to the regulators, the Office of the Australian Information Commissioner (OAIC), and the NZ Privacy Commissioner of their data breach.