Cyber Incident Victim: Queensland School Photography
Date:
Mar 2017
Location:
Australia
Summary
Hackers compromised a school photography company's online payment system, resulting in fraudulent transactions using stolen credit card details of parents. The breach led to unauthorized purchases for flights, accommodation, and ride-sharing services internationally, with individual losses reported in the thousands of dollars. The organization confirmed that only payment card information was accessed, not photographic data, and initiated an investigation with its bank and law enforcement. After temporarily disabling the payment portal, services were restored while affected customers were notified. Multiple parents from various schools experienced financial theft, prompting broader concerns about payment security.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early March 2017, Queensland School Photography experienced a cybersecurity incident affecting customers who paid for school photographs through its online platform. Fraudsters compromised the company's payment system and obtained credit card details, subsequently making unauthorized transactions globally between at least March 8 and March 13. Customers reported fraudulent charges for international flights, accommodation bookings, and ride-sharing services in locations including Europe and the United States. The company detected suspicious activity and took its payment system offline as containment measure while initiating investigations. Operations manager Thurid Cook confirmed the breach appeared limited to payment card information, with no evidence that student photographs or other data were accessed. The organization could not immediately determine the exact number of affected customers due to delayed reporting patterns after their general notification to all clients.
Queensland School Photography engaged its bank for forensic analysis and reported the incident to law enforcement authorities. By March 13, the company had restored its online payment system with enhanced security measures. Multiple parents from different schools reported financial impacts, including Neil Laycock from Tamborine Mountain State School who lost approximately $3,000 through overnight transactions, and Hilliard State School parent Kylie Brouwer whose card was used for $1,200 in flight purchases. Affected customers contacted their financial institutions to dispute charges, with reimbursement processes typically requiring up to six weeks. The incident raised concerns among parents about broader credit card security beyond this specific breach, as evidenced by customer statements questioning payment safety across other platforms.