Hackers Leak Entire Donor History of Every Campaign on This Christian Crowdfunding Site

Just days after leaking the personal details of 92,000 people who donated to the “Freedom Convoy 2022” campaign on Christian-focused crowdfunding platform GiveSendGo, the same hackers appear to have published data on every single campaign ever run on the platform.

According to Distributed Denial of Secrets, a WikiLeaks-like website that’s sharing the leaked information with journalists and researchers, the huge cache contains over 5GB of data that includes the source code for GiveSendGo’s website, data on all the campaigns it’s run, limited credit card data, and unredacted images of identity-verification documents sent to GiveSendGo by those running crowdfunding campaigns.

The data also includes what appears to be the platform’s plans for processing cryptocurrency payments, which they don’t currently accept.

VICE News is in the process of downloading and verifying the data, but Micah Lee, a technologist with a focus on operational security, and director of information security at the Intercept, has already looked through it and found that it contains a lot of information that could be hugely damaging for GiveSendGo.

“[The leak] appears to be a complete dump of their production database. It includes the entire donor history of everyone who’s donated to any campaign before February 11, last Friday,” Lee tweeted on Tuesday evening.

Lee discovered a database of users that contained over 170,000 entries, suggesting that this is the total number of people who’ve created an account on GiveSendGo.

Worryingly for some users, the data leak also contains around 1,400 images of passports, driver’s licenses, and Social Security cards used by those running campaigns to verify their identities. The leaked images were not redacted or protected in any way, Lee said.

Lee was also able to search through the data to find the most profitable campaigns in the site’s history. Unsurprisingly, the “Freedom Convoy 2022” was the most profitable campaign to date, and it continues to rake in donations, with over $9.4 million raised so far.

The second most profitable campaign was one called “Abbichuu Gypsum Board Company,” which is currently disabled on the site but consists of a single donation of $999,999. The money was purportedly being raised to fund “​​detailed feasibility analysis for setting up a manufacturing unit in Ethiopia for the production of gypsum board.” 

Other top-earning campaigns include one for Kyle Rittenhouse’s defense fund and a voting project run by pro-Trump election conspiracist Matt Braynard.

GiveSendGo has not responded to VICE News’ request for comment about the latest data leak. However, just hours before the latest leak was published, the website’s operators posted an update on its social media channels about the leak of the “Freedom Convoy” data.

“GiveSendGo has a dedicated team aggressively focused on identifying these malicious actors and pursuing actions against their cybercrime. At the time of the intrusion, GiveSendGo’s security team immediately shut down the site to prevent further illegal actions against our site. We have also performed many security audits to ensure the security of the site before bringing the site back online,” the company said in a statement.

What the statement didn’t mention is that journalists from the Daily Dot had repeatedly flagged security issues to the company about its servers last week. The company claimed it had fixed the issue, and CEO Jacob Wells called the allegations “fake news” and part of an “intentional hit job” against his company.

Want the best of VICE News straight to your inbox? Sign up here.