The cyberattack on the International Committee of the Red Cross bore the hallmarks of a state or a group with equivalent means, the ICRC's data protection chief said Monday.
Massimo Marelli said he was "told from the people who are doing the forensics analysis that it was a highly sophisticated and targeted operation".
The ICRC revealed on January 19 that it had been the victim of a massive act of computer piracy, during which hackers seized the personal and confidential data of more than 515,000 vulnerable people, some of whom had fled conflicts, had gone missing or were prisoners.
Asked by the development community media platform Devex if the attack was carried out by a country, Marelli replied: "It's sufficiently sophisticated that it's compatible with that, or state-like.
"It was a highly sophisticated and targeted operation."
The hack "could amount to something that is against the letter and spirit of international humanitarian law", he said.
Attributing the most elaborate computer attacks is notoriously difficult, but in the case of the ICRC there is the added dimension of its neutrality.
"It's an area that is very sensitive, in the sense that we wouldn't want the findings to be exploited for political reasons," said Marelli, warning against jumping to conclusions.
Attribution was "not necessarily conducive to our capacity to operate in a neutral, impartial, and independent manner", he added.
Marelli said the attack could severely harm the trust that the ICRC relies on to work with parties to a conflict and affected communities.
"It erodes the capacity for a humanitarian organisation to operate in the first place," he told Devex.
The ICRC's priority is that the hacked data is not used against the individuals concerned.
The data came from at least 60 national Red Cross and Red Crescent Societies around the world.
During conflicts and disasters, families can lose track of a loved one. The ICRC and the national societies work to clarify the fate of missing persons, exchange family messages and reunite loved ones.