Smartpay confirmed customer data was stolen in a ransomware attack

Smartpay Holdings, a payment terminal provider listed on the Australian and New Zealand stock exchanges, discovered a ransomware incident affecting some of its New Zealand systems on June 10, 2023.

The company said on June 16 that its investigation had confirmed criminals took information belonging to a group of customers in Australia and New Zealand from those New Zealand systems. Smartpay did not describe the categories of data involved and said the number of affected customers was still being established.

Smartpay stressed that it does not collect or store individual cardholder or credit card information as part of its transaction processing. It said its payment platforms and terminals continued to operate normally and that merchants did not need to take any action.

The company engaged the cybersecurity firm CyberCX and said it was working with relevant government authorities. It made its formal announcement to the NZX and the Australian Securities Exchange on June 16 and said it would contact affected customers directly as the investigation progressed. A Smartpay spokesman told the New Zealand Herald that the company could not comment on the ransom amount demanded or on whether negotiations were taking place, and the group behind the attack was not publicly named.