Loading story…
Christian crowdfunding platform GiveSendGo suffered a breach that exposed donor information tied to the Canadian Freedom Convoy 2022 fundraiser and related campaigns. Reporting said attackers took the site offline, redirected visitors to GiveSendGone.wtf, and leaked data on more than 92,000 donors, including names and other personal details. VICE identified Aubrey Cottle, also known as Kirtaner, as publicly claiming responsibility for the intrusion, saying he targeted the platform over concerns about foreign political influence in convoy fundraising; reporting also said many donors were based in the United States, while Canadian donors contributed a larger share of the money.
A subsequent leak reportedly expanded the exposure to roughly 5 GB of internal data, including a 2.5 GB MySQL database dump, Bitbucket source code, customer service records, and limited payment-card information such as card last-four digits and expiration dates. The disclosures intensified scrutiny of GiveSendGo’s security after earlier reports of exposed identity documents on its servers, an unresolved researcher warning dating back to 2018, and a separate 2021 donor-data leak linked to fundraising for people involved in the January 6 Capitol riot. GiveSendGo CEO Jacob Wells condemned the breach as illegal and said law enforcement was expected to investigate, while Cottle said he received death threats after claiming involvement.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
On 2022-02-17, Aubrey Cottle publicly said he hacked GiveSendGo, took the site offline, redirected it, and leaked Freedom Convoy donor data. GiveSendGo CEO Jacob Wells condemned the breach and said the company expected a law enforcement investigation, potentially involving the FBI.
On 2022-02-15, reporting revealed another GiveSendGo leak affecting the Freedom Convoy and 'Adopt a Trucker' campaigns. DDoSecrets said it received about five gigabytes of data, including a MySQL database dump, Bitbucket source code, customer service information, and limited donor credit card data such as last four digits and expiration dates.
On 2022-02-14, reporting confirmed that names of Freedom Convoy donors were leaked following the GiveSendGo breach. This marked the public disclosure of the donor-data exposure tied to the convoy fundraising campaign.
By mid-February 2022, attackers breached GiveSendGo, defaced the site, redirected visitors to GiveSendGone.wtf, and exposed campaign and donor data tied to the Freedom Convoy 2022 fundraiser. The leak included personal details for more than 92,000 donors.
In 2021, GiveSendGo experienced a prior donor-data leak connected to fundraising for people involved in the January 6 Capitol riot. Later coverage cited this as an earlier security incident affecting the crowdfunding platform.
In 2018, a security researcher reported that GiveSendGo servers exposed sensitive identity documents and left a warning message. The issue was described as unresolved in later reporting, contributing to scrutiny of the platform's security practices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
vice.com
Open sourcedailydot.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Unknown attackers accessed payment accounts used by the Russian fundraising initiatives **Davayte** and **You Are Not Alone** through a shared Stripe-to-WooCommerce integration used for online auctions. The mid-August intrusions exposed some donor email addresses and, for certain donors, payment-card last four digits and issuing-bank information; organizers said full card numbers, cardholder names, donation details, and evidence of fraudulent transactions were not identified. Davayte supports Ukrainian civilians affected by Russia’s invasion, while You Are Not Alone aids Russian political prisoners and their families. Stripe reportedly stopped the unauthorized access before complete donor-email databases could be downloaded, but the exposed identities create heightened danger because Russian authorities designate the organizations behind the projects as “undesirable,” potentially putting donors at risk of prosecution. The activity remains unattributed, although You Are Not Alone said involvement by Russian security services cannot be excluded.
Sep 3, 2026
Beacon disclosed that attackers used a compromised **AWS access key** exposed in publicly accessible JavaScript build artifacts to access its CRM platform and exfiltrate a full copy of customer data. The company said the intrusion targeted its entire customer base of roughly **1,500 UK charities and non-profits**, with malicious activity beginning on July 27 and lasting about **1 hour and 27 minutes**, matching a sharp spike in AWS data transfers. Because the attacker authenticated with valid credentials, data encrypted at rest was reportedly downloaded in readable form. Exposed information may include supporters’ names, email addresses, phone numbers and donation records, affecting charities in sensitive sectors including healthcare and victim support; Beacon said patient data, payment card data and bank account information were not stored in the compromised CRM environment. The company reported no evidence of persistence, rotated AWS-integrated credentials, removed secrets from client-side assets, added security tooling, and notified UK regulators and law enforcement, while affected organizations such as Justice for Colombia and the Center for Sustainable Energy began warning supporters of potential exposure.
Aug 20, 2026
Beacon CRM said a cyberattack exposed data belonging to a significant number of UK charities that use its platform, after attackers copied database backups and likely downloaded them. The company warned customers to assume that **all data stored in Beacon before July 27**, including attachments, was taken, and said the information may be readable even where customer data had been encrypted. Beacon discovered the incident around July 29 and began notifying affected customers on August 3. Early evidence indicates the attackers gained access using compromised credentials, although Beacon has not disclosed how the credentials were obtained or whether extortion demands were made. In response, the company reset all user passwords and tightened password requirements, while affected organizations including the Molly Rose Foundation assessed potential exposure of donor, supporter, and service-user information; Victim Support said its victim data was not affected.
Aug 13, 2026