A New Zealand payroll operator says it has been caught up in a “global” data security incident that has resulted in unauthorised access to some of its customers’ data.<\/p>\n
Thankyou Payroll, which services a number of charities, said on Thursday<\/a> customer data held by a “third-party reporting tool” called Metabase had been accessed.<\/p>\n None of its own systems had been breached, it said, and its Metabase tool had been taken offline.<\/p>\n Information accessed included names, IRD numbers, email and physical addresses, bank account details and payment histories.<\/p>\n “We know our customers trust us with important information and we apologise for the concern and disruption this incident may cause,” the company said. “We understand that Thankyou Payroll is one of a number of businesses impacted as this is a global incident involving many companies worldwide.”<\/p>\n Thankyou Payroll said it had strengthened its security protections, asked customers to reset their passwords and notified the Office of the Privacy Commissioner.<\/p>\n “Once you complete the mandatory password update upon your next login, your account is fully secure and you can run payroll as normal.”<\/p>\n Reports<\/a> suggest Metabase advised users in August it had found a “critical vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access”. It provided a fix<\/a>, asking users to update “as soon as possible”.<\/p>\n