Charity donor details released in major cyber breach

Charities working to ease donor concerns

In most cases, affected charities have been at pains to stress that no credit card information, banking details or important identification documents were leaked onto the dark web.

Plan International Australia confirmed credit card details of some donors from 2009 had been released, although those details had long since expired.

Plan was among several organisations that raised questions about Pareto’s data retention practices that meant information from as far back as 2007 was kept on its servers.

Plan International Australia CEO Susan Legena said “all activity with Pareto Phone has been suspended and we are no longer working with this business”.

“We trusted Pareto Phone, and we were not aware that this data was still held by Pareto Phone. In keeping this data, Pareto Phone has breached Australian Privacy Principles as well as our own agreement for the data to be destroyed. We have made a formal complaint to the Fundraising Institute of Australia in relation to Pareto Phone and this matter.”

The Australian Conservation Foundation said it had alerted 13,500 supporters affected by the breach.

An ACF spokesperson said the organisation was “dismayed” that personal information was compromised, but stressed no credit cards or identifying documents were involved, there was no evidence the information had been misused, and its own systems had not been affected.

It is among a number of organisations to have raised concerns about Pareto’s data retention practices and said, “We are concerned Pareto kept old data it should have destroyed.”

ACF is among several organisations to have severed relationships with Pareto.

The Fred Hollows Foundation said even though it had not worked with Pareto Phone for nine years, the private details of 1,700 of its donors – which do not include financial details – had been affected.

The charity also said in a statement that it was “deeply disappointed” at the breach and that it was unaware the personal details of donors were still being held by the telemarketer, in breach of privacy laws.

“We worked with Pareto Phone only during 2013 and 2014. We were not aware our data was still held by them.

“Under the Australian Privacy Principles, there is a requirement for personal information data to be destroyed or de-identified once it is no longer needed for the purpose for which it was collected.

“This is a requirement all our partners must comply with. We have requested Pareto Phone delete any remaining data on our donors.”

Canteen, which supports young people battling cancer, contacted 2,600 of its donors after information including names, dates of birth, addresses, email addresses and phone numbers was compromised.

“It has taken some significant time to understand exactly what personal information about a subset of Canteen supporters has in fact been accessed,” a spokesperson said.

“We’re deeply upset that our supporters have been impacted by a data breach at Pareto Phone, a company contracted by Canteen, and we have paused all activity with them.

Canteen said anyone who had not already been contacted had not been affected by the data breach, and that at this stage no financial information had been compromised.

Cancer Council Australia CEO Professor Tanya Buchanan said the organisation was waiting to hear more detail from Pareto Phone as to how many of its donors had been affected and the type of data involved.

“Cancer Council understands that we are one of many charities that Pareto Phone has worked with that have been impacted by their data breach,” said Professor Buchanan.

She said as information came to hand, the charity was immediately notifying anyone who had been adversely affected, which to date was “a very small number.”

Professor Buchanan als said the Cancer Council was no longer using Pareto Phone.

Médecins Sans Frontières (MSF) used Pareto Phone until 2018 and in a statement, MSF said, “Pareto Phone have advised that some personal information from MSF donors has been compromised in this data breach.”

“We are currently working with Pareto Phone to understand the impact that this breach may have had. We are contacting any affected MSF supporters as soon as it is clear who has been affected and what information has leaked.”

Many organisations, including WWF Australia, have advised supporters to review their security.

In advice mirrored by other organisations, it urged its donors to take the following actions:

• remain alert to fraudulent and suspicious activity
• seek support from IDCARE – Australia’s national identity and cyber support service
• review passwords
• seek more information on cyber security.

Ransomware attacker identified by dark web watcher

Global data threat intelligence platform Falcon Feeds, which tracks more than 25,000 dark web sources, has identified the hackers as coming from the LockBit ransomware group.

It said LockBit had obtained 150 GB of data in the hack.

According to the Australian Signals Directorate, 18% of all ransomware incidents in the country in the year to March 2023 originated from the LockBit group.

The ASD described LockBit as the most common ransomware variant in the world and said it had been “prolific” in the past year, recruiting “affiliates” to attack an array of sectors using a wide range of tactics.

“This variance … presents a notable challenge for organisations working to maintain network security and protect against a ransomware threat,” the ASD warned.

Cyber Security Connect journalist David Hollingworth, in an analysis of the data dump, said the information appeared to have been downloaded from a single hard drive.

But he said “the elephant in the room” was the issue of data retention.

“This is a huge trove of data, some of it nearly two decades old. A lot of it is detailed, much of it involves personally identifiable information, and some of it is quite sensitive. In other words, it is very useful data for scammers and phishers, who might be able to grab the name of someone from accounts, spoof their email address, and then contact another employee to catch them in a scam. And that’s just the tip of the iceberg.”

Falcon Feeds’ Nandakishore Harikumar urged organisations to take a multi-pronged approach to protection.

This included:

• regularly updating staff with training on and awareness of the “current threat landscape”, and helping them recognise suspicious emails, links, and attachments to prevent cyber threats
• keeping systems up-to-date to minimise vulnerabilities
• having a reliable backup system to avoid issues with restoring data
• contacting security vendors for periodic security audits to identify vulnerabilities
• having a comprehensive incident response plan, which should be regularly updated.

“This cannot be achieved through a single process; you need to have combination of tools, strategy and practices,” Mr Harikumar said.

He said organisations should know that LockBit was just one of a number of ransomware groups, with names such as Noescape, Play, Medusa, Thysida, Cl0p, 8Base, Akira and Knight.

He said organisations could also be targeted by DDoS (distributed denial of service) attacks by Anonymous Sudan and Noname, which had run an OpAustralia campaign.

He warned that attackers were now using generative AI to develop more sophisticated phishing methods to deceive users into revealing crucial access information, such as passwords.

Formal probe on the cards as watchdog seeks more details

The Office of the Australian Information Commissioner (OAIC) said it had been notified of the cyber-attack and continued making preliminary inquiries into the case.

According to its guidelines, inquiries are often a prelude to a formal investigation.

“The OAIC is monitoring the situation to ensure that the requirements of the NDB scheme have been met,” an OAIC spokesperson said.

Under the Notifiable Data Breaches (NDB) scheme, organisations covered by the Privacy Act must notify the OAIC and affected individuals as soon as practicable if they “experience a data breach that is likely to result in serious harm to individuals whose personal information is involved”.

A survey last year by not-for-profit tech support agency Infoxchange revealed many NFPs were unprepared to deal with cyber security threats.

The Digital Technology in the Not-for-Profit Sector study revealed that more than 54% of NFPs have conducted no staff training in cybersecurity.

Just under half don’t have a response plan to deal with data breaches.

Commenting at the time of the Optus data breach late last year, Australian Information Commissioner and Privacy Commissioner Angeline Falk said recent data breaches were a wake-up call for every organisation.

“Organisations in the not-for-profit sector can reduce the risk of human error by promoting staff awareness about secure information handling practices,” she said.

Ms Falk urged organisations to collect only necessary personal information and then to delete it when no longer needed.

She suggested that organisations should visit the OAIC website for advice.

Charities regulator urges checks when working with third parties

A spokesperson for the Australian Charities and Not for profits Commission (ACNC) said that while working fundraising agencies enables charities to raise funds while allowing them to focus on charitable purposes, responsible people at those charities should conduct due diligence to ensure they were sufficiently informed about the policies, processes and practices of a fundraising agency before entering into any agreement.

This included ensuring fundraising agencies have policies for data protection (including financial information security), and for managing risk and effectively responding in the event of a cybersecurity attack, or data breach.

The federal government has worked in recent years on fundraising reform and reached agreement in February to adopt a set of National Fundraising Principles – including principles relating to working with commercial fundraisers and the collection, use and management of information.

Fundraisers watching developments closely

GiveNow, a donations platform which is a sibling enterprise to the Institute of Community Directors Australia (ICDA), is among fundraising platforms watching the breach closely.

GiveNow executive director Cathy Truong said the breach was just the latest to hit the sector.

“It is devastating for all parties involved, especially the unsuspecting donors,” Ms Truong said.

“While no financial information was included in this breach, it is the theft of personal information that is distressing for donors.”

Ms Truong said the cyber attack was a timely reminder of the responsibilities of all players in the fundraising sector to maintain data security, including:

• asking third party providers about their security protocols before engaging with them
• being discerning about what information is handed over. This includes giving only the data needed to fulfil the task.
• not collecting more information from donors than absolutely necessary.

“We at GiveNow recommend that our organisations collect no more personal information than first name, last name and email address from donors,” said Ms Truong.

More information

• Ten questions every board member needs to ask about cybersecurity
• Free cybersecurity policy
• Why you need our free privacy policy (and download template)
• Cyber liability insurance from Our Community partner Aon
• ICDA spotlight report highlights cyber crime threat
• CommBank cyber safety resources
• Australian Cyber Security Centre
• Scamwatch
• ACNC guidance to charities about managing data
• Office of the Australian Information Commissioner

Infoxchange:

• Digital Transformation Hub
• Cybersecurity essential protections for NFPs
• Self-paced cybersecurity training for NFPs