Posted on November 22, 2022 at 6:33 PM

Details Of 80,000 Donors Leaked In Smith Family Charity Organization Data Breach

The Smith Family stated that the personal details of 80,000 donors may have been exposed and accessed by hackers who targeted its servers to steal funds.

The Australian charity offers support to disadvantaged children. The charity stated that although the hackers tried to steal money, their attempts were not successful.

Investigation of the incident revealed that the threat actors could have accessed the names, email addresses, and phone numbers of the donors.

In some cases, the first and last four digits of the donors’ credit cards were exposed, although this did not lead to any full exposure of their details.

The Hackers Cannot Make Any Fraudulent Purchase With The Details

The Smith Family said no CVV, expiry date, or middle digits of the cards were exposed. “The Smith Family does not store that information in its systems,” the charity added.

Also, the Smith Family does not hold, request, or collect personal identity documents such as driver’s licenses or passports of its donors, since these are not required when processing their donations. As a result, the hackers can’t use the accessed data to make any fraudulent purchase or transaction.

The Charity also stated that no evidence suggests anyone’s personal information has been misused. However, as a show of precaution, the charity decided to warn customers so that they can be well prepared to protect themselves in case of phishing attacks in the future. With information about the hackers’ exploits and their targets, the customers will be able to protect themselves.

The Smith Family says it is ever committed to protecting the personal information of all its supporters and donors and apologized for any stress or inconvenience the notification of the incident may have caused. Additionally, the charity has called on cybersecurity experts to further strengthen the security system of the organization.

Australian Companies Continue To Suffer Massive Cyber Attacks

The incident comes after recent hacking incidents on some high-profile companies, such as health insurer Medibank and Telecommunications giant Optus.

In the Medibank attack, the data of millions of customers were stolen in an unprecedented cyber attack. Medibank’s boss stated that the organization was reaching out to 500,000 customers that were affected, and whose health data is believed to have been stolen in the incident. This comes weeks after the company learned about the hacking incident on its servers.

Chief Executive Officer of Medibank, David Koczkar, stated that the company recently communicated with about 480,000 customers whose health records were also breached. He added that the company’s security team was analyzing millions of records across several applications to match customers’ data from several sources.

Two months ago it was the turn of Telecommunications giant Optus, to suffer a hacking incident, considered one of the biggest hacks in history.

According to the company, the hacking incident affected 10 million customers. At the time, Chief Executive Officer Kelly Rosmarin stated that the hacking incident was a frustrating one as it was caused by an exposure that gave an offshore-based entity access. The hackers had access to customers’ driver’s licenses, home addresses, and passport numbers of about 40% of the entire population of Australia.

Investigation into the attack is still ongoing, but the Australian Federal Police said there were reports that some of the stolen customer data are being sold on the dark net. Optus also revealed little details of how the attackers were able to breach its systems. According to the report, the hacker’s IP address appeared to move between countries in Europe.

Following the attacks and the subsequent data exposure of millions of Australians, there has been a widespread clamor for the various incidences to be investigated.

Experts Criticize Government’s Data Retention Policy

In most cases, hackers are always looking for avenues to make money either by selling the stolen data or asking for ransom. But on other occasions, they are being sponsored by state actors looking for important information from critical organizations or just disrupting the operations of the targeted entity. But in the case of the series of attacks witnessed among Australian companies, the motive has always been to steal the data and sell it to the highest bidder.

Some experts are criticizing the federal government for what they call “bad policy” on data retention. According to the experts, the government has maintained a very poor policy around data retention which has left Australians’ personal information open to being stolen.