The personal data including the addresses of more than half a million blood donors across Australia has been compromised in a massive security breach at the Red Cross, which has been blamed on human error.
Australian Red Cross Blood Service chief executive Shelly Park said at a press conference in Melbourne on Friday that the data had been accessed by an “unauthorised person”.
“We learned that a file, containing donor information, which was located on a development website, was left unsecured by a contracted third party who develops and maintains our website,” Park said.
“The issue occurred due to human error. Consequently, this file was accessed by a person outside of our organisation.”
She said access to the file had been shut down and that forensic experts were now helping the organisation with their investigation. The hacked file was a back-up of web-based inquiry forms that are submitted to the Red Cross blood donation webpage.
“The back-up file contained 550,000 people, who completed a web form to access a donation between 2010 and 2016,” she said.
“The type of information included in the files include name, address, and personal details that come about from completing our short questionnaire, which is a bit like a gateway to see whether people can go ahead to donate blood.
“I wish to stress that this file does not contain the deep personal records of people’s medical history or of their test results. We are notifying donors as early as we believe we can, and we are notifying donors today.”
Cyber security experts had told the organisation that the risk of the data being misused was low, Park said. Australia’s computer emergency response team, AusCERT, is also working with the organisation to address the problem.
However, donors have been warned to be on alert for phone and email scams.
“We are extremely sorry,” she said. “We are deeply disappointed to have put our donors in this position. We apologise and take full responsibility for this. We apologise and we acknowledge that this is unacceptable. Our apology is unreserved. Donors have an expectation and aright to think that all of their information that they share with us is held accountably and responsibly.
“We have let them down.”
Those affected have been sent a text message that reads: “The Blood Service has identified a potential data issue that may affect you” with a link to the blood service’s website for more information.
Each week in Australia, 25,000 patients need a donation of blood to save or to improve their life.