Convoy of Hope

The Washington State Office of the Attorney General disclosed a data breach affecting Convoy of Hope (COH), a nonprofit organization, in February 2021. The incident occurred on February 7, 2020, but was only detected on December 9, 2020, exposing the personal data of 1,017 Washington residents. The compromised information included names and full dates of birth, though no financial, medical, or highly sensitive details (e.g., Social Security numbers) were reported as stolen. The breach highlights a significant delay in detection (nearly 10 months), raising concerns about COH’s cybersecurity monitoring and response protocols. While the exposed data was limited to basic identifiers, such attacks can still enable identity theft, phishing, or fraud if combined with other leaked datasets. The lack of evidence suggesting broader exploitation (e.g., financial fraud or ransomware) suggests the attackers may have targeted personal records for secondary misuse rather than immediate monetary gain. COH likely faced reputational damage and potential regulatory scrutiny under state data protection laws, particularly given the prolonged exposure window. The incident underscores the vulnerabilities even nonprofits face in safeguarding constituent data against evolving cyber threats.

Source: https://www.atg.wa.gov/data-breach-notifications | https://data.wa.gov/resource/sb4j-ca4h.json?id=10383

TPRM report: https://www.rankiteo.com/company/convoyofhope

"id": "con038090625",
"linkid": "convoyofhope",
"type": "Breach",
"date": "2/2020",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '1,017',
                        'industry': 'Humanitarian Aid / Disaster Relief',
                        'location': 'United States (Washington residents '
                                    'affected: 1,017)',
                        'name': 'Convoy of Hope (COH)',
                        'type': 'Non-profit Organization'}],
 'data_breach': {'number_of_records_exposed': '1,017',
                 'personally_identifiable_information': ['names',
                                                         'full dates of birth'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)']},
 'date_detected': '2020-12-09',
 'date_publicly_disclosed': '2021-02-01',
 'description': 'The Washington State Office of the Attorney General reported '
                'a data breach involving Convoy of Hope (COH) on February 1, '
                '2021. The breach occurred on February 7, 2020, and was '
                'discovered on December 9, 2020, affecting 1,017 Washington '
                'residents with compromised information including names and '
                'full dates of birth.',
 'impact': {'data_compromised': ['names', 'full dates of birth'],
            'identity_theft_risk': 'High (PII exposed)'},
 'references': [{'source': 'Washington State Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'Washington State '
                                                       'Office of the Attorney '
                                                       'General'},
 'response': {'communication_strategy': 'Public disclosure via Washington '
                                        'State Office of the Attorney General'},
 'title': 'Convoy of Hope (COH) Data Breach',
 'type': 'Data Breach'}