An intruder accessed donation details at Secours Islamique France

Donors to Secours Islamique France received an unusual email. The humanitarian NGO, based in Massy (Essonne), says it detected unauthorized access to part of its data, including that of its donors. The specialist sites Fuites Infos, Cyberattaque.org and FrenchBreaches relayed the message on November 6 and 7.

According to these sites, the data involved includes last name, first name, postal address, email, phone number and donor code, as well as donation details: date, amount, chosen designation and transaction reference. Bank details used for online payments reportedly were not affected, as the organization explains that they are handled by its bank's payment platform and are not stored in its database.

Why a donation's designation is not trivial

The donation form on the sif.org site lets donors give their zakat, the religious almsgiving of Islam. For donors who chose this designation, the exposed field can reveal a religious practice, as Fuites Infos points out. Under the GDPR, data revealing religious beliefs falls into special categories that are more strictly protected, just like the political opinions exposed in the leak of the Communist Party's membership file.

What the organization has not said

The number of donors affected, and the date and duration of the intrusion, have not been disclosed. It is unknown whether the data was only viewed or was copied. The organization says the problem was quickly resolved and that it has strengthened its security. FrenchBreaches claims it notified the CNIL (the French data protection authority) and filed a complaint, which the other sources do not mention. On the morning of November 7, the donor information page on sif.org made no mention of the incident.

Best practices

• be wary of unexpected donation appeals, requests to "regularize" payments or payment confirmations, which may cite your donor code or your amounts;
• check the sender: legitimate addresses end in sif.org or secours-islamique.org, among others;
• if in doubt, call the donor service at 01 60 14 14 14 or type the sif.org address yourself;
• never give bank details over the phone; help is available at cybermalveillance.gouv.fr.

It remains to be seen how many people are affected. The organization has not yet said.