Ransomware at Derry data firm Evide hit charities serving abuse survivors

Evide, a data management company based in Derry that supplies its Impact Tracker platform to charities and non-profit organisations across Ireland and the UK, was hit by ransomware in late March 2023. The company said it noticed unusual traffic on its network, found that its systems had been compromised and reported the matter to the Police Service of Northern Ireland, which confirmed receiving a report from a local business on March 30.

Evide handles data for around 140 organisations. Reporting in mid April indicated that up to nine charities in the Republic of Ireland had data taken, at least four of which work with survivors of rape or sexual abuse. RTE reported an estimate that around 2,000 people in Ireland could be affected, a group that included service users, survivors and alleged perpetrators.

One in Four, a Dublin charity supporting adults who experienced childhood sexual abuse, said it had contacted about 500 people whose information may have been involved and set up a helpline for those concerned. The charity said personal information had been accessed but that attachments, letters and reports made to child protection services were not.

A ransom was demanded and Evide said it had not paid. As of mid April none of the stolen material had appeared on criminal leak sites. Evide said it had engaged cyber security specialists and notified its clients and the relevant authorities. Specialist detectives from the PSNI Cyber Crime Investigation team led the investigation with assistance from An Garda Siochana, and the Irish Data Protection Commission confirmed it had received breach notifications.