Kiwi payroll firm caught up in 'global' data breach

A New Zealand payroll operator says it has been caught up in a "global" data security incident that has resulted in unauthorised access to some of its customers' data.Thankyou Payroll, which services a number of charities, said on Thursday customer data held by a "third-party reporting tool" called Metabase had been accessed.None of its own systems had been breached, it said, and its Metabase tool had been taken offline.Information accessed included names, IRD numbers, email and physical addresses, bank account details and payment histories."We know our customers trust us with important information and we apologise for the concern and disruption this incident may cause," the company said. "We understand that Thankyou Payroll is one of a number of businesses impacted as this is a global incident involving many companies worldwide."Thankyou Payroll said it had strengthened its security protections, asked customers to reset their passwords and notified the Office of the Privacy Commissioner."Once you complete the mandatory password update upon your next login, your account is fully secure and you can run payroll as normal."Reports suggest Metabase advised users in August it had found a "critical vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access". It provided a fix, asking users to update "as soon as possible".One analyst said there were thousands of potential targets, including "critical infrastructure sectors including government, healthcare, energy, finance, telecom, aviation, and large public organisations".Thankyou Payroll said passwords and credit card numbers were safe.The breach was reported the same day it was reported a large number of files relating to clinical trials run by ZenTech - a privately owned New Zealand company - may have been stolen.