2,841 Iraqi NGO Staff Emails and Phones Leaked in October

In October 2024, personal information for 2,841 people connected to the Iraqi Department of Non-Governmental Organizations showed up on a dark web forum. This wasn't a ransomware attack or a dramatic hack with a manifesto. It was a straightforward database dump containing names, emails, and phone numbers. Here's what went wrong and why you should care.

The Danger: This data represents a complete directory of individuals actively working in Iraq's civil society sector. For organized crime groups, state actors, or local bad players, having a list of NGO workers is gold. They can use phone numbers for social engineering attacks (posing as officials), emails for targeted phishing, and the names for intimidation or reputation damage. The exposure is particularly risky because NGO workers often work on sensitive issues like human rights.

What Was Leaked: 2,841 records containing first names, last names, email addresses, and phone numbers. No passwords were included, which is good news for account security but bad news for physical safety and targeted harassment. The dataset came from the department's core registration system, meaning it was highly struktured and easy to weaponize.

Why It Matters: Government databases holding details of activists and civil society workers have been exploited before for surveillance and intimidation. Even in 2024, this remains a real threat vector. The breach shows how quickly detailed personal information can move from internal servers to public forums where anyone can access it.

What NGO Workers Should Do: Change email passwords immediately, espeshally if you reuse them. Enable two-factor authentication on email and any accounts linked to your work. Be cautious of phone calls claiming to be from government agencies; verify independently. Document any suspicious emails or calls. Alert your organization's security team and ask for a briefing on how to spot phishing attempts designed for your sector.