Cyber Incident Victim: Amnesty International Australia
Date:
Apr 2022
Location:
Australia
Summary
A cyber incident involving unauthorized access to systems at third-party supplier Pareto Phone potentially exposed personal information of some Amnesty International Australia supporters, including names, addresses, contact details, and birth dates, though financial data remained uncompromised. The breach initially led to suspended operations with Pareto, followed by temporary resumption after assurances that donor data wasn't accessed, but activities were halted again upon discovery that supporter information might have been impacted. After Pareto implemented extensive security improvements across technology, processes, and training, Amnesty resumed collaboration while maintaining ongoing monitoring of all third-party suppliers to ensure data protection standards. Forensic investigations determined the exposed data posed low risks of misuse.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The cyber incident involving Amnesty International Australia (AIA) stemmed from a breach at third-party supplier Pareto Phone, first detected in April 2022. Pareto Phone, which conducted supporter outreach campaigns for AIA, experienced unauthorized access to its systems, resulting in some data being disclosed online. Initial assurances from Pareto Phone in April indicated no evidence of donor data exfiltration, with accessed files reportedly limited to campaign background documents devoid of personal information. Based on these assurances, AIA temporarily suspended activities with Pareto but resumed operations in May 2022 after Pareto engaged cybersecurity experts to investigate.
In August 2023, Pareto Phone informed AIA that supporter data might have been compromised, prompting AIA to suspend activities again and initiate its own forensic analysis. The investigation revealed unauthorized access to basic supporter information—including names, physical addresses, email addresses, mobile numbers, and dates of birth—but no financial data. Cybersecurity experts assessed the exposed data as presenting a low risk of misuse. Pareto Phone implemented large-scale technological and procedural improvements, enhanced staff training, and notified Australian authorities including the Office of the Australian Information Commissioner and the Australian Cyber Security Centre. AIA maintained suspension of Pareto operations until September 2023, resuming only after verifying Pareto’s remediation efforts. AIA committed to ongoing monitoring of all third-party suppliers to ensure data protection standards. Affected supporters received notifications starting in August 2023, with AIA providing guidance on recognizing scams and securing online accounts while apologizing for the breach. Pareto Phone ceased trading at an unspecified later date, though AIA continued operational reviews to safeguard supporter resources.