Smartpay

Profile narrative

Smartpay is a New Zealand-based electronic funds transfer at point of sale (eftpos) payment system operator. The organisation facilitates eftpos transactions for retailers across New Zealand and Australia, providing payment terminals and transaction processing services to merchant customers. As an eftpos provider, Smartpay occupies a position in the retail payments infrastructure connecting merchants to the broader payments ecosystem, with its services forming part of the point-of-sale technology used by businesses to accept electronic payments. The company does not store cardholder or payment card data, a structural aspect of its service model that became significant in the context of its disclosed cyber incident.

Smartpay is publicly listed on the New Zealand stock exchange, as indicated by the market reaction to its disclosure of a cyber incident, when its share price fell following the announcement. The organisation serves retailer customers in both New Zealand and Australia, giving it a trans-Tasman operational footprint in the payments sector. Its payment terminals and transaction processing services remained fully operational for retailers during its 2023 cyber incident, allowing merchants to continue accepting electronic payments without interruption despite the underlying compromise of certain internal systems.

A distinguishing attribute of Smartpay is the nature of the data it does and does not handle. Because the company does not collect or store individual cardholder or payment card information, the 2023 ransomware incident, while resulting in the theft of information belonging to a group of retailer customers in New Zealand and Australia, did not involve the compromise of payment card data. This separation between merchant-facing operational data and payment card data is a notable structural feature of its service offering. The organisation also demonstrated an established incident response capability, engaging external cybersecurity specialists CyberCX and coordinating with relevant authorities to contain the breach, conduct forensic investigation, and determine the scope of the data theft.

At the time of the reported incident, the full scope of the data theft and the number of impacted retailer customers remained under investigation, and Smartpay indicated it was directly contacting affected customers. The combination of its trans-Tasman merchant base, its publicly listed status on the New Zealand market, and its role as a payment terminal provider to retailers collectively define Smartpay's position within the New Zealand and Australian payments landscape.

Incidents

2 incidents linked to this organisation.