Queensland School Photography

Summary

Hackers compromised a school photography company's online payment system, resulting in fraudulent transactions using stolen credit card details of parents. The breach led to unauthorized purchases for flights, accommodation, and ride-sharing services internationally, with individual losses reported in the thousands of dollars. The organization confirmed that only payment card information was accessed, not photographic data, and initiated an investigation with its bank and law enforcement. After temporarily disabling the payment portal, services were restored while affected customers were notified. Multiple parents from various schools experienced financial theft, prompting broader concerns about payment security.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early March 2017, Queensland School Photography experienced a cybersecurity incident affecting customers who paid for school photographs through its online platform. Fraudsters compromised the company's payment system and obtained credit card details, subsequently making unauthorized transactions globally between at least March 8 and March 13. Customers reported fraudulent charges for international flights, accommodation bookings, and ride-sharing services in locations including Europe and the United States. The company detected suspicious activity and took its payment system offline as containment measure while initiating investigations. Operations manager Thurid Cook confirmed the breach appeared limited to payment card information, with no evidence that student photographs or other data were accessed. The organization could not immediately determine the exact number of affected customers due to delayed reporting patterns after their general notification to all clients.

Queensland School Photography engaged its bank for forensic analysis and reported the incident to law enforcement authorities. By March 13, the company had restored its online payment system with enhanced security measures. Multiple parents from different schools reported financial impacts, including Neil Laycock from Tamborine Mountain State School who lost approximately $3,000 through overnight transactions, and Hilliard State School parent Kylie Brouwer whose card was used for $1,200 in flight purchases. Affected customers contacted their financial institutions to dispute charges, with reimbursement processes typically requiring up to six weeks. The incident raised concerns among parents about broader credit card security beyond this specific breach, as evidenced by customer statements questioning payment safety across other platforms.

Sources

Sources available to members: 1 source.