2026 World Food Programme — Gaza self-registration app breach (~600k households; May 31)
Data compromised
Names, ID numbers, mobile numbers, and location data for Gaza assistance registrants
Technical writeup
The World Food Programme confirmed in early June 2026 that unauthorized actors accessed personal information submitted through its Palestine self-registration application (SRA), where individuals register for food and cash assistance after verification. Reporting in The New Humanitarian and DataBreaches.net cited roughly 600,000 Gaza households affected—described as potentially the largest-known breach of humanitarian beneficiary data—with exposed fields including names, ID numbers, mobile numbers, and location data. WFP notified aid recipients via Telegram on May 31 and said it was investigating the security-related incident.
Root cause
Unauthorized access to humanitarian self-registration application data