Humanitarian organizations increasingly depend on digital registration and data-management systems to deliver aid, a dependence accompanied by rising exposure to cyberattacks against conflict-affected and displaced populations. This study undertakes a qualitative comparative content analysis of the crisis communication responses of two major humanitarian actors - the International Committee of the Red Cross (ICRC), following its 2021-2022 data breach affecting more than 515,000 people, and the World Food Programme (WFP), following its 2026 breach of the Self-Registration Application for Palestine affecting approximately 600,000 Gaza households. Initial source verification indicates that both cases are independently documented and sufficiently comparable for a preliminary comparative analysis, while important differences in temporal observability remain: the ICRC corpus spans a documented communication trajectory from January to at least June 2022, while the WFP corpus, as currently assembled, spans four confirmed official communications issued between 31 May and 9 June 2026. Drawing on organizations' official communications, coded inductively across an evidence-linked scheme before engagement with Situational Crisis Communication Theory (SCCT) and Image Repair Theory (IRT), the analysis identifies a shared underlying sequence - acknowledgement, containment, corrective action, beneficiary guidance, and continuity assurance - alongside a divergence in how each organization treats the limits of its own disclosure. The ICRC corpus documents an accountability- and explanation-centered pattern in which limited disclosure is accompanied by an explicit, organization-stated protective rationale, termed here protection-bounded transparency. The WFP corpus, extended through 29 July 2026, documents comparably limited disclosure - including an internal staff directive to avoid technical explanation of the incident - without an equivalent stated rationale, a pattern termed institutional reticence and explicitly contested as unjustified by external stakeholders. The study proposes a preliminary Humanitarian Cyber Crisis Communication and Protection Framework (HCCCPF), organized around a central Protection Boundary construct requiring organizations to state, not merely enact, the rationale for any limits on disclosure. This framework is offered as an evidence-grounded but provisional contribution, pending closure of the full communication corpus for both cases.
