Cyber Incident Victim: Legacy of War Foundation
Date:
Jan 2023
Location:
United Kingdom
Summary
An online charity auction of Banksy prints organized by the Legacy of War Foundation to fund humanitarian aid for Ukraine experienced significant disruption due to cyberattacks originating from Russian IP addresses, with over 3,500 hostile attacks targeting the registration system amid more than a million total requests. The attacks necessitated manual verification of legitimate entries for the limited-edition artworks, delaying the selection process while the foundation worked to secure proceeds intended for medical vehicles, emergency generators, heaters, and support services for vulnerable populations affected by the conflict.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early January 2023, the Legacy of War Foundation, a UK-based international charity supporting civilians in conflict zones, partnered with artist Banksy to auction 50 limited-edition screenprints to fund humanitarian aid for Ukraine. The prints, priced at £5,000 each, featured a mouse sliding down a "FRAGILE"-labeled box, with unique scratch marks applied by Banksy using a pizza cutter. Prospective buyers were required to register online for the sale. During the registration period, the charity's website experienced over 1 million requests, including approximately 3,500 hostile attacks originating from Russian IP addresses. These attacks involved rogue registrations that disrupted the auction process, requiring the foundation to manually review entries before notifying successful applicants. The incident was publicly disclosed by the charity on January 10, 2023, through a website statement acknowledging the attacks while thanking supporters for their patience.
The cyber attacks temporarily delayed the auction process but did not prevent the charity from proceeding with fundraising efforts. Proceeds were designated to purchase ambulances, support vehicles, generators, gas heaters, and solar-powered lights for Ukrainian civilians facing winter energy shortages, with specific allocations for disabled individuals, elderly populations, civilian casualties, and shelters for women and LGBTQ communities. The incident occurred alongside Banksy's confirmed creation of seven street murals in war-damaged Kyiv-area buildings, one of which was stolen but later recovered. While the cyber attacks did not compromise financial transactions or artwork distribution, they highlighted operational security challenges for humanitarian organizations during high-profile fundraising events. The foundation maintained its commitment to delivering aid, with CEO Giles Duley outlining specific plans for resource distribution in Ukraine following the auction's completion.