Cyber Security Breach on ICRC
Frequently asked questions for family tracing users
Last updated 9 January, 2023
What has happened?
In January 2022, the International Committee of the Red Cross (ICRC) discovered a cyber security breach. Hackers had gained unauthorised entry into the ICRC computer network and access to servers that contained information relating to the global Red Cross and Red Crescent Movement’s Restoring Family Links services.
The ICRC has taken the servers supporting the Family Links services and all information offline while they investigate the incident.
The British Red Cross' media statement about the ICRC cyber security breach can be found here.
Who should I contact if my data has been affected?
Advice for people who may be affected
What is the British Red Cross doing?
How can I find out more information?
Download FAQs in your language:
- Për më shumë informacion, ju lutemi lexoni pyetjet tona më të shpeshta (Albanian)
- للمزيد من المعلومات ، رجاءاً اقرأ قسم الأسئلة الشائعة (Arabic)
- ለበለጠ መረጃ እባክዎን የእኛን FAQs ያንብቡ (Amharic)
- لطفا برای اطلاعات بیشتر، قسمت سوالات و جوابات را مطالعه کنید (Dari)
- لطفاً بخش سؤالات رایج را برای اطلاعات بیشتر مطالعه کنید (Farsi)
- Veuillez lire notre FAQ pour plus d'informations (French)
- تکایە بۆ زانیاری زیاتر پرسیارە دووبارەبووەکان FAQsی ئێمە بخوێنەوە (Kurdish Sorani)
- Maaloo odeeffannoo dabalataaf gaaffiiwwan keenya yeroo hedduu gaafataman (FAQ) dubbisaa (Oromo)
- مهرباني وکړي د نورو معلوماتو لپاره زمونږ پرله پسي پوښتني ولولئ. (Pashto)
- Fadlan akhri su'aalahayaga soo noqnoqda FAQs si aad u hesho macluumaad dheeraad ah (Somali)
- ዝያዳ ሓበሬታ ንምርካብ በጃኹም ኣብ FAQs ዝብል ኣንብቡ (Tigrinya)
- Vui lòng đọc các câu hỏi thường gặp của chúng tôi để có thêm thông tin (Vietnamese)
Who has done this, and what will they do with the information?
The ICRC believes this was a sophisticated cyber security breach and they do not know who is behind it. At the present time, there is also no evidence that the cyber security breach has resulted in a personal data being either lost, stolen, misused or published.
What data is affected?
The cyber security breach involved unauthorised access to ICRC’s servers containing information relating to the global Red Cross and Red Crescent Movement's Restoring Family Links service.
The ICRC is working with external experts to analyse the situation and identify if any personal data has been impacted.
The personal data that may have been impacted includes the following categories:
- information about individuals searching for their families and details of family members, for example names, gender, dates of birth, place of birth, racial or ethnic origin
- addresses, email addresses and telephone numbers
- information about the family relationship between individuals looking for their families and the missing family members.
- Look out for any emails, texts or phone calls that seem suspicious.
- If you receive an unexpected email or text message claiming to be from the Red Cross or asking for your personal information, do not click on any links in the message. Immediately delete the message and do not forward or share it.
- Do not respond to these messages or give personal details to unexpected emails that you may receive.
- Whenever in doubt, please email: dataprotection@redcross.org.uk before taking any further steps.
- If you are concerned for your safety, please contact the police.
This incident impacts the British Red Cross International Family Tracing service only, which has been temporarily suspended. It does not affect any other British Red Cross services or data.
The British Red Cross and the ICRC are working together to investigate the ICRC's cyber security breach and assess whether any personal data has been impacted.
Advice for people who have been affected
Following ICRC's cyber security breach, it's important to be cautious about responding to emails, texts or phone calls that you think might not be genuine.
For example, if you receive an unexpected email or text message claiming to be from the Red Cross or asking for your personal information:
Do not click on any links in the message
Immediately delete the message and do not forward or share it
Do not respond to these messages or share personal details.
Who shall I contact if I am concerned about my personal data?
At this stage, neither ICRC nor British Red Cross is aware of any actual or threatened misuse or publication of personal data. Nevertheless, it is always advisable to remain vigilant:
What is the British Red Cross doing?
The British Red Cross and ICRC are working closely together as well as with external experts to analyse the cyber security breach and determine what has happened, as well as assess whether any personal data has been impacted.
We are in the process of contacting people who may have been affected on a precautionary basis, so we can inform and support them. We are closely monitoring the situation and will keep our website updated if anything changes.
How can I find out more information?
International Tracing Service
Because of the cyber security breach, the ICRC and British Red Cross have taken the decision to pause our International Family Tracing service for now as a precaution. During this time, we are unable to give any updates on open cases or accept new referrals. We are looking into ways we can continue this vital work and will update this page as soon as we can.
We very much regret what has happened, and we understand that upon hearing about the ICRC’s cyber security breach it may be worrying for some people who have been in contact with our International Family Tracing service.
We have set up a dedicated free telephone line for anyone who is being supported by British Red Cross International Family Tracing service who has questions or would like talk about the breach of ICRC’s cyber security.
We will update this webpage when we have more information to share.
Do you have a question about this page or want to give us feedback? Visit our Contact us page.