Oxfam Australia investigates data breach after database put up for sale

Oxfam Australia investigates a suspected data breach after a threat actor claimed to be selling their database belonging on a hacker forum.

Oxfam Australia is a charity focused on alleviating poverty within the indigenous Australian people and people from Africa, Asia, and the middle east. The charity is part of a confederation of twenty charities worldwide operating under the Oxfam umbrella.

Last week, BleepingComputer learned of a threat actor claiming to be selling a database containing the Oxfam Australia contact and donor information for 1.7 million people.

The database samples seen by BleepingComputer included names, email addresses, addresses, phone numbers, and donation amounts.

BleepingComputer has confirmed that one of the records contains legitimate data for a donor from sample data shared by the threat actor.

When BleepingComputer learned about this sale, we contacted Oxfam Australia, who immediately stated that they were investigating the situation.

Oxfam Australia discloses a suspected data breach

Today, Oxfam Australia told BleepingComputer that they continue to investigate the breach and reported it to the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC).

"Late last week, Oxfam Australia was alerted to a suspected data incident. Oxfam immediately launched an investigation and engaged market leading experts to assist in identifying whether data may have been accessed and any impact on its supporters."

"Chief Executive Lyn Morgain said Oxfam Australia had reported the matter to the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC) while continuing to investigate the suspected incident," disclosed their suspected data incident notification.

Oxfam Australia has told BleepingComputer that it is unknown what data was potentially accessed and how many people were affected.

The charity is investigating the incident and will update its security advisory as more information is known.

What should Oxfam Australia donors do?

While the cyberattack has not been officially confirmed, based on the threat actor's information, it is likely that a data breach occurred.

With this in mind, BleepingComputer recommends all donors and registered members change their password on the Oxfam Australia site. If you use that same password on other sites, you should change it there as well.

Threat actors can also use the alleged data in this database to perform targeted phishing attacks.

All donors should be on the lookout for phishing attacks claiming to be from Oxfam and asking for further personal information.

Further recommendations are provided by Oxfam in their suspected data incident notification.