Australian Red Cross apologizes for largest Aussie data breach to date

They’ve taken responsibility, but it wasn’t their *direct* fault…

David bisson
David Bisson

Australian Red Cross apologizes for largest Aussie data breach to date

The Australian Red Cross Blood Service has apologized for the largest data breach that’s affected the “Land Down Under” to date.

Shelly Park, chief executive of the Blood Service, issued an apology on 28 October in response to a breach that compromised the data of hundreds of thousands of Aussie blood donors:

“We are incredibly sorry to our donors. We are deeply disappointed this could happen. We take full responsibility and I assure the public we are doing everything in our power to not only right this but to prevent it from happening again.

Sign up to our free newsletter.
Security news, advice, and tips.

“We need your continued support to donate blood and feel confident that this will not reoccur in the future.”

Donate bloodThe Australian Red Cross wasn’t the first to learn of the breach, however.

On 25 October, an unnamed individual contacted security researcher Troy Hunt and provided him with a dataset from

The data consisted of a 1.74GB file with 1,286,366 records in a “donor” table for the American Red Cross Blood Service, including listings for Troy Hunt and his wife.

In total, the file contained the personal information for 550,000 unique donors, including the following bits of data:

  • Name
  • Physical and email address
  • Date of birth
  • Donor eligibility questions, including whether each donor had engaged in “sexually risky behavior” in the last 12 months

Curious, Hunt asked the user how they came into possession of the data.

Here’s how Hunt described what he was told:

“What he’d actually been doing is simply scanning internet IP addresses and looking for publicly exposed web servers returning directory listings. This is literally as simple as going to an address such as and seeing a list of all the files on the system (sample address only). He’d then look to see if any of those files contained a .sql extension which would indicate a database backup… and that is all. I’ll come back to why this data was there a little later.”

Hunt subsequently contacted Australia’s Computer Emergency Response Team (AusCERT), with which the Australian Red Cross had a pre-existing membership.

Since learning of the breach, the Blood Service has begun notifying everyone who applied to be a donor using the website. They’ve even set up a hotline to help reassure each and every affected user that their personal information is safe.

Clearly, the Australian Red Cross has taken responsibility for the breach. But was it their fault?

The answer: yes and no.

The user who found the data did so because one some at Precedent, a company contracted by the Blood Service to redesign and maintain, accidentally published the file (which was essentially a database backup) to a public-facing website and had enabled directory browsing enabled.

At this time, the contractor is looking into the issue to find out what happened.

In the meantime, Hunt has asked that the user delete all of the Australian Red Cross information he found. The security researcher elected to do the same instead of uploading it to the Have I Been Pwned? website

Anyone who has used to apply to be a donor should contact the hotline set up by the American Red Cross.

Also, while it’s common for consumers to back away from services that have been breached, please don’t do so in this case. The Australian Red Cross does some amazing work. They’ve owned up to what happened, so let’s continue to support them and trust in the fact that they’ll do a better job securing donors’ information in the future.

David Bisson is an infosec news junkie and security journalist. He works as Contributing Editor for Graham Cluley Security News and Associate Editor for Tripwire's "The State of Security" blog.

One comment on “Australian Red Cross apologizes for largest Aussie data breach to date”

  1. StefanL

    You twice refer to the 'American' Red Cross when surely the story is about the 'Australian' Red Cross.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.