Charity data stolen in ransomware attack on supplier

The Police Service of Northern Ireland (PSNI) and Ireland’s An Garda Síochána are probing a series of data breaches at several charities working with vulnerable individuals, including victims child sexual abuse, after their data was compromised in a cyber attack on an IT supplier.

The supplier, Derry-Londonderry-based Evide, is a data management services firm specialising in third-sector organisations. Its Impact Tracker platform is used by charities across in Ireland and the UK to manage campaign data and outcomes.

It is understood it was targeted by an as-yet undisclosed ransomware operator in March 2023. According to RTÉ, its attackers have demanded a ransom, but Evide has not paid.

In a statement, Evide said: “We recently became aware of an incident when unusual traffic was detected on our network. As soon as we became aware that a third party had accessed our systems we immediately contacted the PSNI and engaged the services of experienced cyber security specialists to assist us to contain the issue, support recovery efforts, and conduct a thorough investigation.

“We have provided notifications to all relevant stakeholders and clients and also notified the relevant authorities, including the Police Service of Northern Ireland who notified An Garda Síochána. The incident is now also subject to a criminal investigation.”

Two of the charities known to have been hit are Dublin-based One in Four, which works with adult survivors of child sexual abuse, and Belfast-based Orchardville, which supports adults with autism and learning disabilities.

One in Four said it learned of the breach on 5 April when it was notified in the course of Evide’s investigation.

“We now know that the personal information of people who have used our service has been accessed,” the organisation said in a statement.

“We have begun contacting individual clients directly to advise them of the incident and to address any concerns they may have. We have taken this approach to allow us to provide proper supports to clients who may find this incident distressing. Our priority at all times is to the welfare and wellbeing of our clients.”

Speaking to RTÉ, the charity’s CEO Maeve Lewis said she was unsure what data had been stolen, but that it did likely include personal information.

Orchardville, meanwhile, said it was also working to establish what data had been compromised and has warned service users to be on the alert for suspicious contacts.

“It’s reprehensible but attacks like this against some of the most vulnerable are popular with certain cyber criminals,” said Comparitech security specialist Brian Higgins.

“The instinctive reaction of victim organisations will always be to do their utmost to protect those they are charged with helping and this can often be exploited as a motivation to pay a ransom quickly rather than risk any further harm.

“It appears that Evide, its affected clients, and PSNI, have a comprehensive incident response plan in action and are doing their utmost to see out this despicable attack in the recommended fashion.

“Their comms strategy is very clear and anyone who thinks they may be affected or know somebody who is a client of any of the listed victim organisations should follow the advice issued by PSNI and report any unsolicited messages about the attack. Never engage or reply. Only report and delete,” he added.