World Food Programme breach exposes data of 600,000 Gaza households (2026)

On 2 June 2026, the United Nations World Food Programme (WFP) — the world's largest humanitarian organisation — disclosed that attackers had gained unauthorized access to its self-registration application (SRA) for Palestine, the platform Gazans use to register for food and cash assistance after verification. The breach exposed personal data for roughly 600,000 households in Gaza, in what researchers described as possibly the largest known breach of humanitarian beneficiary data to date.

What happened

WFP said the intrusion occurred on 14 May 2026 and that it later detected unauthorized access to the SRA. The exposed information included names, ID and mobile numbers, and location data — details that are especially dangerous in an active conflict zone where they could be used for surveillance, targeting, or fraud against an already vulnerable population.

On discovering the access, WFP took immediate action to shut down the platform, contain the intrusion, and strengthen its security controls. An investigation is under way, and at the time of disclosure no party had claimed responsibility.

Why it matters

Humanitarian beneficiary registries hold some of the most sensitive data imaginable: precise identities and locations of people who depend on aid to survive. A compromise of that data does not just risk identity theft — it can put lives at risk. The WFP incident underscores how aid platforms have become high-value targets and how the duty of care owed to beneficiaries now extends squarely into cybersecurity.