AIPAC discloses data breach, customer information stolen

The American Israel Public Affairs Committee (AIPAC) has announced that it has been struck by a cyberattack, in which personally identifiable information (PII) was exfiltrated.

In a data breach filing addressed to the Maine Attorney General, the organization says that the data breach was discovered on or around August 28th, 2025.

Security researchers discovered that the attackers were able to access information stored on the organization’s IT systems between October 20th, 2024, and February 6th, 2025.

“The organization undertook the time- and resource-intensive steps of determining whether those files contained personally identifiable information (PII) and to identify the data subjects to whom that PII related,” AIPAC said in its data breach notification.

Although the organization doesn’t specify what personally identifiable information was involved in the data breach, it could cover a wide range of personal details, including full names, phone numbers, email addresses, postal addresses, copies of driver’s licenses or passports, and banking information.

According to the data breach notification, 810 people were affected by the incident, including one resident from the state of Maine. AIPAC began notifying affected customers on November 13th, 2025. So far, there are no signs of any misuse of leaked personal information.

As of writing, no ransomware operation has claimed responsibility for the data breach.

The American Israel Public Affairs Committee, or AIPAC, is a pro-Israel lobbying group founded in 1954 and aims to influence policies in the legislative and executive branches of the United States government.

Since 2021, AIPAC has raised funds for political candidates itself. In addition, it has a vast pool of donors. On its website, the organization claims to have more than five million members who wish “to strengthen and expand the US-Israel relationship.”

In the past, critics have accused AIPAC of being strongly allied with Israel’s Likud party and the US Republican Party. The organization has always denied these accusations by labeling them “malicious mischaracterizations.”

Unlock more exclusive Cybernews content on YouTube.