Payroll Data Security is Critical

With the current core system AI attacks and specific recent payroll data breaches it is critical that payroll data is protected from access and manipulation.

Standard software data protection, including encryption, MFA, and other software protections, may not be enough, as seen in recent Australian and USA government agency attacks.

Payroll needs well-designed critical data isolation and protection well beyond multi-factor sign-in.

Using third-party platforms as part of your payroll system may also expose risks beyond the payroll software itself.

Payroll needs its own model that brings in better data protection.

 Recent NZ payroll data breach

A payroll company in New Zealand announced it had been caught up in a data security breach.

https://www.rnz.co.nz/news/business/1327439/kiwi-payroll-firm-caught-up-in-global-data-breach

A New Zealand payroll operator says it has been caught up in a “global” data security incident that has resulted in unauthorised access to some of its customers’ data.

Thankyou Payroll, which services a number of charities, said on Thursday customer data held by a “third-party reporting tool” called Metabase had been accessed.

None of its own systems had been breached, it said, and its Metabase tool had been taken offline.

Information accessed included names, IRD numbers, email and physical addresses, bank account details and payment histories.

“We know our customers trust us with important information and we apologise for the concern and disruption this incident may cause,” the company said. “We understand that Thankyou Payroll is one of a number of businesses impacted as this is a global incident involving many companies worldwide.”

Thankyou Payroll said it had strengthened its security protections, asked customers to reset their passwords and notified the Office of the Privacy Commissioner.

“Once you complete the mandatory password update upon your next login, your account is fully secure and you can run payroll as normal.”

Reports suggest Metabase advised users in August it had found a “critical vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access”. It provided a fix, asking users to update “as soon as possible”.

One analyst said there were thousands of potential targets, including “critical infrastructure sectors including government, healthcare, energy, finance, telecom, aviation, and large public organisations”.

Thankyou Payroll said passwords and credit card numbers were safe.

The breach was reported the same day it was reported a large number of files relating to clinical trials run by ZenTech – a privately owned New Zealand company – may have been stolen.

The solution to critical  data protection

Inzenius, an award-winning leader in payroll system design with patented processes, builds security into its system from the ground up.  

Frequently Asked Questions.

Can payroll data be protected from these types of attacks?

It takes an innovative approach and stringent compliance reviews to aid in mitigating the risk of data breaches beyond the software code itself 

What steps are critical to protect data access?

Setting up your SOC and ISO 27001 protocols is a good start, but the human side of data access and theft needs management oversight.

Only keep data required in your systems  

What can be undertaken in the short term?

Educate your team members on good security protocol adherence  

Where should we look for payroll systems that have the best data security protocols?

Unfortunately, the best companies won’t advertise their security protocols, but you can ask about their processes when you are considering replacing your current system.

I can recommend Inzenius as an innovator in payroll