“We know our customers trust us with important information and we apologise for the concern and disruption this incident may cause,” the company said. “We understand that Thankyou Payroll is one of a number of businesses impacted as this is a global incident involving many companies worldwide.”
Thankyou Payroll said it had strengthened its security protections, asked customers to reset their passwords and notified the Office of the Privacy Commissioner.
“Once you complete the mandatory password update upon your next login, your account is fully secure and you can run payroll as normal.”
Reports suggest Metabase advised users in August it had found a “critical vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access”. It provided a fix, asking users to update “as soon as possible”.
One analyst said there were thousands of potential targets, including “critical infrastructure sectors including government, healthcare, energy, finance, telecom, aviation, and large public organisations”.
Thankyou Payroll said passwords and credit card numbers were safe.
The breach was reported the same day it was reported a large number of files relating to clinical trials run by ZenTech, a privately owned New Zealand company, may have been stolen.