This is a work in progress. While we strive for accuracy, some breach details may be incomplete or pending verification.

SmartPay

Summary

SmartPay, Australasia's largest independently owned EFTPOS provider, suffered a ransomware attack in June 2023 that compromised customer data from its New Zealand systems. The attack was first detected on 10 June 2023, with confirmation of data theft announced on 16 June 2023. SmartPay engaged cybersecurity firm Cyber CX and worked with government authorities to respond to the incident.

What Happened

SmartPay first became aware of a cyberattack on 10 June 2023, when ransomware affected some systems in New Zealand. The company's ongoing investigation confirmed on 16 June 2023 that criminals had stolen information pertaining to a group of customers in Australia and New Zealand from their New Zealand systems.

The attack targeted SmartPay's business systems rather than its payment processing infrastructure. Importantly, SmartPay emphasised that it does not collect or store individual cardholder information when processing transactions, limiting the potential exposure to merchant customer data.

Impact on Individuals

The company did not specify what customer information was compromised in the attack. However, the breach affected merchant customers in both Australia and New Zealand who use SmartPay's EFTPOS services.

SmartPay supports over 37,000 merchants and processed over 78 million transactions worth $2.7 billion in the previous year. Customers were assured they could continue using their payment terminals normally, as the ransomware attack did not affect the operational payment processing systems.

Organisational Response

SmartPay engaged Cyber CX, a leading cybersecurity firm, to provide assistance in investigating and containing the incident. The company worked with government authorities in both Australia and New Zealand to respond to the breach.

SmartPay stated that understanding the extent of the data theft was their highest priority and continued investigating to determine exactly what information had been compromised. The company emphasised that payment terminals remained secure and functional throughout the incident.

Verification Source: View original statement