Nearly 25,000 email addresses and passwords for employees of major public health organizations were dumped online, according to the Washington Post.
Angela Lang/CNET
Email addresses and passwords for almost 25,000 employees at high profile health organizations fighting the novel coronavirus
pandemic were dumped online and spread via Twitter, according to a report published by The Washington Post on Wednesday. The World Health Organization, the Centers for Disease Control and Prevention, the Bill & Melinda Gates Foundation and the National Institutes of Health were among the groups reportedly affected by the exposed data, according the paper.
SITE Intelligence Group, which reports on the activities of extremist groups from all over the world, found the data and reported its spread, according to the paper. It’s unclear whether the data came from breaches of systems belonging to the affected groups or from earlier data breaches of other systems. An Australian security researcher told The Post that the WHO passwords worked to log into employees’ emails. Email and password combinations for people at the Wuhan Institute of Virology, a facility near the Chinese city were the disease was discovered, also circulated online.
The spread of the information comes as the world battles COVID-19, a potentially deadly respiratory disease caused by the novel coronavirus. More than 2.6 million cases of the disease have been confirmed around the world, killing more more than 182,000 people, according to Johns Hopkins University.
The WHO, the CDC and the World Bank, which was also reportedly affected, didn’t respond to requests for comment. The NIH declined to comment specifically on the incident, but said, “We are always working to ensure optimal cyber safety and security for NIH and take appropriate action to address threats or concerns.”
The Gates Foundation said it is monitoring the situation. “We don’t currently have an indication of a data breach at the foundation,” the organization said in a statement. The Wuhan Institute of Virology didn’t immediately respond to a request for comment.
CNET found archived versions of some the data. According to The Post, a neo-Nazi group has been sharing the information on Twitter and encouraging people to use the data to harass employees of the affected organizations. Twitter said it’s doing bulk takedowns of URLs that attempt to spread the data.