[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How Did Red Cross Get Hacked?](/blog/how-did-red-cross-get-hacked) Publish date July 4, 2025 {x} minute read # How Did Red Cross Get Hacked? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The January 2022 International Committee of the Red Cross (ICRC) data breach was caused by an unpatched critical vulnerability in the Single Signe-In tool developed by Zoho, a business software development company. After exploiting the vulnerability (tracked as [CVE-2021-40539](https://nvd.nist.gov/vuln/detail/cve-2021-40539)), the cybercriminals deployed offensive security tools to help gain access to ICRC's contact database, resulting in the compromise of more than 515,000 globally. > Offensive security tools are used by penetration testers to discover system vulnerabilities that could be potentially exploited by cybercriminals. The sophistication of these offensive tools and obfuscation techniques adopted to prevent detection is only privy to a small number of Advanced Persistent Threat (APT) groups, suggesting this was likely a State Sponsored attack. [Learn about Advanced Persistent Threats >](https://www.upguard.com/blog/what-is-an-advanced-persistent-threat) > "The hackers made use of considerable resources to access our systems and used tactics that most detection tools would not have picked up."\ > \ > \- Excerpt from ICRC's[ data breach statement.](https://www.icrc.org/en/document/cyber-attack-icrc-what-we-know) ## How Did the Red Cross Data Breach Happen? The following sequence likely led to the Red Cross data breach.  1. State-Sponsored hackers target a Swiss contractor used to store data for the International Committee of the Red Cross. 2. Network access is achieved by exploiting unpatched critical vulnerability CVE-2021- 40539. 3. Offensive security tools are deployed, disguising the threat actors as legitimate internal users.  4. Offensive tools masking the threat actors as administrators permit access to a database of 515,000 people, despite it being encrypted. Among the compromised data were details of individuals receiving services from the International Red Cross and Red Crescent Movement due to armed conflict, natural disasters, or migration. 5. 70 days after the breach, ICRC's third-party cybersecurity service detects a suspicious anomaly on ICRC servers containing sensitive data. 6. A deep dive into the anomaly confirms the compromise of ICRC's server and the sensitive data contained therein on 9 November 2021. 7. Compromised servers are taken offline. ‍ See how your organization's security posture compares to the ICRC's.[View ICRC's security report.](https://www.upguard.com/security-report/the-international-committee-of-the-red-cross) ‍ ## How to Prevent an Incident lIke the Red Cross Data Breach A series of important lessons can be learned from the Red Cross data breach. Applying them to your cybersecurity program could help your organization avoid a similar fate. ### 1. Commit to a Rigorous Security Patch Program ICRC's vulnerability management processes failed to detect and address the exploit that led to this data breach - an oversight likely resulting from the difficulty of managing ICRC's complex, large-scale patching processes, which address tens of thousands of patches across multiple systems annually. Unfortunately, cybercriminals are not sympathetic to complex cybersecurity problems. They will take advantage of whatever exploit they discover - especially when their attacks are well-planned and targeted, which seems to be the case in this instance. Re-evaluate your current vulnerability patching routine to ensure it can rapidly address new critical vulnerabilities published on the  [National Vulnerability Database (NVD)](https://nvd.nist.gov/). ### 2. Follow a Regular Penetration Testing Schedule Despite having a multi-level cyber defense system in place comprising of endpoint monitoring and scanning software, ICRC was still breached. While it's fair to attribute the success of the attack to unusually sophisticated hacking techniques rather than the insufficiency of ICRC's cybersecurity program, this event highlights the importance of having backup processes for detecting security exploits should internal efforts fail. Establish a regular penetration testing schedule for detecting network, system, and application vulnerabilities across your entire IT ecosystem. Pen testing methods should be commensurate to the complexity of cyberattacks likely to target your organization. High data breach risks industries, such as [finance](https://www.upguard.com/industries/financial-services), [healthcare](https://www.upguard.com/industries/healthcare), and [technology](https://www.upguard.com/industries/technology), should assume they will be targeted by highly-complex cyber attackers. If you prefer to manage pen testing internally rather than outsourcing to a third-party, here are some offensive security tools you should be aware of:  * **Metasploit: **An open-source framework for developing, testing, and executing exploits * **Nessus:** A vulnerability scanner that can identify and assess vulnerabilities in networks and systems * **Maltego: **A tool for open-source intelligence and forensic analysis * **Aircrack-ng:** A suite of tools for wireless network cracking * **Cain and Abel**: A password cracking tool * **John the Ripper**: A fast password-cracking tool * **Social Engineer Toolkit (SET):** A tool for performing social engineering attacks ### 3. Implement Advanced Persistent Threat Controls. To defend against APTs, it is important to implement a multi-layered security strategy that includes the following: * **Network segmentation: **Segmenting your network into smaller subnets to obfuscate lateral movement and sensitive resource detection.\ \ [Learn the top network segmentation best practices >\ ](https://www.upguard.com/blog/network-segmentation-best-practices) - **Regular risk assessments:** Identifying vulnerabilities in both your internal and third-party network to identify attack vectors facilitating potential malware injections \ \ [Learn more about risk assessments >](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) * **Advanced threat detection solutions: **Utilizing advanced threat detection and response solutions, such as intrusion detection and prevention systems (IDPS) and endpoint detection and response (EDR) solutions. * **Security awareness and education:** Educating your employees about the risks of APTs and how to identify and report suspicious activity. - **Regular backups:** Regularly backing up your data to expedite recovery if systems are compromised. * **Regular software updates and patching:** Keeping all software and systems updated and patched to prevent exploitation through known vulnerabilities.\ ‍ * **Implementing an incident response plan:** Having an incident response plan to ensure calculated response efforts following a breach.\ \ [Learn how to create an Incident Response Plan >](https://www.upguard.com/blog/creating-a-cyber-security-incident-response-plan) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 26, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)