GiveSendGo givesendgo.com GiveSendGo data breach: what happened and what to do
In February 2022, attackers breached the fundraising site GiveSendGo and obtained donor records. Have I Been Pwned lists 89,966 accounts with names, email addresses, post codes, donation amounts and comments. The data was later shared with journalists and researchers.
View all 13,115 breaches- Breach date
- 7 Feb 2022
- Made public
- 14 Feb 2022
- Affected
- 89,966
- Data exposed
- Email addresses, Geographic locations, Names, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
GiveSendGo is a Christian crowdfunding site. In February 2022 it hosted a fundraiser for the Canadian "Freedom Convoy" protest. According to TechCrunch, attackers briefly redirected the site and then passed donor records to a group that said it would share them with researchers and journalists. Have I Been Pwned added the data on February 15, 2022.
What was exposed
HIBP lists 89,966 accounts. The data covers names, email addresses, post codes (listed as geographic locations), and the donation amount and any comment left at the time of donation.
This breach is sensitive because of what the data says about you: a donation to a politically charged cause, next to a name and a postal area. Being named publicly can lead to harassment, workplace or social consequences, and scam emails that play on the cause.
What this means for you
There were no passwords in the data, so a password change isn't the priority. The risks are exposure and targeted messages. Emails that mention GiveSendGo, a donation or the protest can be phishing. Copies of such leaks tend to keep circulating after the first release.
What to do if you were in it
- 1
Expect targeted phishing
Be wary of emails or texts that mention GiveSendGo, your donation or the protest, especially ones asking you to click, log in or pay.
- 2
Tighten who can find you
Check what shows when someone searches your name: social profiles, people-search listings and old posts. Lock down privacy settings you don't need public.
- 3
Use a separate email for sensitive causes
If you donate to causes you'd rather keep private, use an email alias that doesn't carry your name.
- 4
Check other breaches
Check whether your email or phone number shows up in this and other breaches. A free scan from Serus looks across breach databases and the dark web and alerts you when your data appears.
Frequently asked
Was I in the GiveSendGo breach?
HIBP lists 89,966 accounts. Search your email address there to see whether yours is included.
What was exposed?
Names, email addresses, post codes, donation amounts and donation comments.
Were passwords exposed?
HIBP doesn't list passwords for this breach.
Should I change my password?
It isn't required by this breach, but changing a password you reused on other sites is always sensible.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
