iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
A cyber attack on SmartPay that led to customer data being exposed has ignited an investigation by the eftpos hardware provider.
SmartPay announced that it was first made aware of the attack on 10 June and that by 16 June, it had become aware that information had been stolen.
“On Saturday, 10 June 2023, SmartPay discovered that it was experiencing a ransomware cyber incident affecting some systems in New Zealand,” the company said in its announcement to the ASX.
“On Friday, 16 June 2023, our ongoing investigation confirmed that criminals have stolen information pertaining to a group of customers in Australia and New Zealand from our New Zealand systems.”
The company added that on hearing about the incident, it immediately sought the assistance of cyber security professionals from CyberCX and that it is “working with the relevant government authorities”.
SmartPay advised that despite customer data having been accessed by threat actors, it does not collect or store any cardholder information or credit card information “as part of [its] transaction processing”.
At this stage, SmartPay customers are free to use their terminals as normal and are not required to take any action. The company also said that it would be contacting those affected by the breach and that “understanding the contents and extent of that data theft is now the highest priority of [its] investigation”.
Not much is currently known about the ransomware incident, such as who has been affected, what data has been accessed and who is behind the attack.
Ransomware attacks of this nature have spiked in recent months, which has ignited the argument on whether companies should or shouldn’t pay ransom demands, and discussion on whether these payments should be banned.
The general consensus from most organisations is that meeting a threat actor’s demands only encourages them and paints a target on that organisation for future attacks, as attacks will know them as someone who will pay up.
“In line with advice from cyber crime experts, Latitude strongly believes that paying a ransom will be detrimental to our customers and cause harm to the broader community by encouraging further criminal attacks,” said Latitude, just one major organisation that has suffered recently from a ransomware attack.
While a criminal organisation may promise to decrypt or delete data after ransom demand has been paid, as Home Affairs and Cyber Security Minister Clare O’Neil said, these groups cannot be trusted to stick to their word.
“The idea that we’re going to trust [hackers] people to delete data that they have taken off and may have copied a million times is just frankly silly,” said Minister O’Neil.
“We’re standing strong as a country against this; we don’t want to fuel the ransomware business model.”
[See more – OP-ED: SHAVING TIME AND COMPLEXITY OFF RANSOMWARE RECOVERY]
Be the first to hear the latest developments in the cyber industry.
