Hackers infect Make-A-Wish Foundation website with code that generates cryptocurrency
Hackers successfully broke into the international website of the Make-A-Wish Foundation and inserted malicious computer code which used the computers of people visiting the site to generate cryptocurrency.
Cybersecurity business Trustwave said on Monday that it had found malicious software running on the Make-A-Wish Foundation’s international website, worldwish.org.
Cryptocurrencies, including Bitcoin, are generated through a process called “mining” which uses computing power to perform complex calculations. The more computing power that is available, the faster cryptocurrency can be generated.
Hackers have repeatedly broken into popular websites in order to piggyback off the computers of people visiting the sites.
In February, it was reported that hackers had broken into the website of multiple UK government websites in order to perform a similar “cryptojacking” attack. Websites including the Information Commissioner’s Office, the Scottish NHS helpline and hundreds of other government pages were compromised to mine cryptocurrency.
The Make-A-Wish Foundation’s website has since been cleared of the malicious code, Trustwave said.
Sylvia Hopkins, the chief administrative officer of Make-A-Wish International, said that "we are aware that the Make-A-Wish International Worldwish.org website was impacted by a vulnerability, which has been removed and remedied. No Make-A-Wish International donor or constituent data was compromised by this incident. Make-A-Wish International is redoubling its efforts to maintain website security against third-party threats."
Gavin Millard, vice president of intelligence at cybersecurity business Tenable, said the attack on the Make-A-Wish Foundation is “criminal activity and the harsh reality is that scripts don’t care about morals, location, vocation, or even the organisation running the site".
"They just look to exploit poor cyber hygiene to monetise no matter the impact. When it comes to charitable organisations who want to spend all the money realising their mission, it’s hard to justify budget on employing a significant IT Security team,” he said.
The attack on the Make-A-Wish Foundation follows a Sunday Telegraph report that Russian hackers managed to break into the online website of Cancer Research UK in 2016.
The “Magecart” hacking group attempted to intercept the card details of cancer sufferers purchasing items through the site. However, the charity said that no card details were stolen in the attack.
Some charities have explored the legitimate use of cryptocurrency-mining code by asking visitors to their website to agree to donate their computing power. In April, UNICEF’s Australian branch launched a website which allowed people to help the charity by leaving the page open on their computers to mine cryptocurrency.
