OAIC Determination - 2022 Cyber Incident
To our valued customers,
Vinomofo acknowledges the determination of the Office of the Australian Information Commissioner (OAIC) following its investigation into our handling of personal information in relation to the cyber security incident we experienced in 2022.
While the OAIC recognised that we had a range of technical and organisational security measures in place at the time of the incident, the determination outlines steps for us to further strengthen our information security and governance practices. We accept the OAIC’s findings, and we are committed to implementing all required actions. In the spirit of continuous improvement as a business, we’ve also taken steps since the incident to further secure our IT environment and strengthen our systems to help prevent any similar incidents happening again. Protecting the privacy and security of our customers’ information has always been, and remains, our highest priority.
Once again, we sincerely apologise for any concern and inconvenience the incident caused at the time. We remain fully committed to protecting your information and ensuring your experience with Vinomofo is enjoyable.
If you have any questions, please email team@vinomofo.com
Thank you for your support.
Justin Dry,
Co-founder and CEO
Vinomofo
FAQ
1. What has happened?
The Office of the Australian Information Commissioner (OAIC) has issued a determination following its investigation into our personal information handling practices, following the cyber security incident experienced by the company in 2022. While the OAIC recognised that we had a range of technical and organisational security measures in place at the time of the incident, the determination outlines steps for us to further strengthen our information security and governance practices. We accept these findings and we are committed to implementing all required actions.
2. What are you doing about it?
In the spirit of continuous improvement as a business, we are already well advanced in implementing measures to further secure our IT environment and strengthen our systems to help prevent any similar incidents happening again.
We are also engaging an independent privacy and cyber security expert to review and validate the improvements we’ve made, and we will continue to work constructively with the OAIC to implement all required actions.
3. What information was impacted in the 2022 cyber incident?
This cyber security incident involved a third party unlawfully accessing one of Vinomofo’s databases that was not linked to our live Vinomofo website. This temporary migration database was being used at the time to enable a significant upgrade to Vinomofo’s digital platform. The database contained personal information such as names, email addresses, phone numbers, dates of birth and addresses. It did not include financial or identity data such as passports, driver licences or credit card details.
As soon as we were alerted to the suspected cyber security incident, we immediately commenced a thorough investigation with leading cyber security and forensic specialists.
Our investigation established that an external third party posted a sample of the illegally accessed Vinomofo information externally, which was investigated by our cyber security and forensic specialists. However, the risk to our customers from this information being accessed remains low.
Nevertheless, in our commitment to communicating transparently during the incident, we notified our customers and members at the time about the precautionary steps that they could take to protect their information and privacy.
4. Were customers’ bank details or credit cards impacted in the cyber incident?
No. Vinomofo did not – and does not – hold identity or financial data such as passports, drivers’ licences or credit cards/bank details. The investigation at the time also established that no passwords, identity documents or financial information relating to our customers were accessed.
5. Where can I get more information?
The types of personal information that Vinomofo collects, and how we collect, handle and use that information, is documented within our Privacy Policy.
If you have any further questions, please contact team@vinomofo.com.
