Hackers Expose Donor Data from Russian Fundraisers for Ukrainians and Political Prisoners

Fundraisers Targeted

Two Russian fundraising initiatives, Davayte and You Are Not Alone, disclosed that their payment accounts were compromised by hackers. Davayte raises funds for Ukrainian civilians affected by the conflict, while You Are Not Alone supports Russian political prisoners and their families. Both projects reported the incidents on Tuesday, stating the attacks took place in mid-August.

Method of Attack

The attackers exploited a vulnerability in an integration between the payment processor Stripe and WooCommerce, an e-commerce plugin for WordPress. Both projects utilized this integration for conducting online auctions. The threat actor gained access through this common entry point.

Data Exposed

The breach resulted in the exposure of donor email addresses. In some instances, the last four digits of payment cards and information about the issuing banks were also accessed. Full card numbers, cardholders' names, and specific donation details were not compromised. Stripe intervened, blocking unauthorized access before the entire database of donor email addresses could be downloaded, and found no evidence of fraudulent transactions.

Response and Investigation

Following the incident, Davayte disabled third-party integrations, rotated its access keys, and informed the relevant European data protection authority. The identity of the attackers remains unknown. You Are Not Alone stated they are investigating whether the attack was carried out by cybercriminals or Russian security services.

Project Background

Davayte, launched in February 2024 by independent Russian media organizations like Meduza and TV Rain, has raised over $437,000 for humanitarian aid in Ukraine. You Are Not Alone, organized by independent Russian media and opposition groups since 2023, has raised approximately $1.4 million and assisted around 800 political prisoners and their relatives.