State Department Says It’s ‘Concerned’ About Red Cross Hack

(Bloomberg) -- A cyberattack on the International Committee of the Red Cross was a “dangerous development,” the U.S. State Department said, warning it could harm vulnerable people.

“We are concerned by the breach, announced last month, of sensitive data held by the International Committee of the Red Cross,” State Department spokesperson Ned Price said in a statement. “Targeting the Red Cross and Red Crescent Movement's sensitive and confidential data is a dangerous development.”

The Swiss humanitarian organization disclosed the hack last month, pleading with the hackers not to release stolen data.

“This cyber incident has harmed the global humanitarian network's ability to locate missing people and reconnect families,” Price said. “This is why it is so vital that humanitarian data be respected and only used for intended purposes.” Price said other countries should support the Red Cross by “raising the alarm about this breach.”

Red Cross spokesperson Crystal Ashley Wells said, “Many states have come out in condemnation of this and offering support around it since it happened. The U.S. will be the latest to do so.”

The Red Cross hasn't said who was behind the attack, and hasn't had any contact with the hackers. The organization was forced to take some of its systems offline as a result of the incident, “severely limiting the humanitarian services we can offer to the over half a million people affected,” according to a Jan. 21 statement. Some Red Cross websites still remain offline.

“Servers hosting the personal information of more than 500,000 people receiving services from the Red Cross and Red Crescent Movement were compromised in a sophisticated cybersecurity attack,” the Red Cross said in a statement. The servers were operated by a third party and stored sensitive Red Cross data, the agency said.

There has no indication that any of the compromised Red Cross data has been leaked. Hackers first entered Red Cross systems on Nov. 9, and the breach was discovered Jan. 18, according to the agency.

“The people affected include missing people and their families, unaccompanied or separated children, detainees and other people receiving services from the Red Cross and Red Crescent Movement as a result of armed conflict, natural disasters or migration,” the Red Cross said.

Cybersecurity specialists from Microsoft Corp. have been assisting the Red Cross its its recovery efforts, according to people familiar with the matter.