The Smith Family

Profile narrative

The Smith Family is a children's charity headquartered in Australia. Its activities involve raising funds to support children's welfare. To process donations, the organization collects and retains certain donor information. This information includes donors’ names, contact details such as phone numbers, postal addresses and email addresses, as well as the status and amount of each donation transaction. For payment card data, the charity stores only the first and last four digits, omitting middle digits, expiry dates and CVV codes. The retained data enables the organization to verify donations and maintain accurate financial records.

On 22 November 2022, the charity was targeted by a cyberattack that involved an unsuccessful attempt to divert funds from its accounts. Although the theft attempt did not succeed, the intrusion potentially exposed a range of donor personal information held by the organization. The exposed data comprised names, phone numbers, residential or mailing addresses, email addresses, donation transaction statuses and amounts, and the partial card details (first and last four digits) that were stored. Importantly, the breach did not compromise middle card digits, expiry dates, CVV numbers, passport details or driver’s licence information, as those data types were not retained in the charity’s systems. In response, the Smith Family issued a public apology to affected donors, enacted immediate security enhancements, and engaged external cybersecurity experts to conduct a thorough investigation. To assist donors with questions or concerns, the organization provided a dedicated support email address and committed to ongoing transparency regarding the incident and its aftermath.

Incidents

1 incident linked to this organisation.