Thankyou Payroll has identified and contained a data security incident involving information held in a third party reporting tool.
No Thankyou Payroll accounts or our core payroll system were accessed. These systems continue to operate without disruption. However, customer data held in the third-party reporting tool was accessed..
We know our customers trust us with important information and we apologise for the concern and disruption this incident may cause. We understand that Thankyou Payroll is one of a number of businesses impacted as this is a global incident involving many companies worldwide.
What happened?
We identified unauthorised access linked to a third-party reporting tool used by Thankyou Payroll.
We acted immediately to take the third-party system offline and strengthen security protections for customer accounts.
What information was involved?
The information accessed included:
Names
IRD numbers
Email addresses
Physical addresses
Bank account details
Full pay history
The affected information relates to current and historical customers.
What have we done?
We have:
Taken the third-party reporting system offline.
Strengthened security protections for customer accounts.
Required customers to reset their Thankyou Payroll password.
Notified the Office of the Privacy Commissioner.
Provided customers directly with information, guidance and support.
What should I do?
The main concern at this stage is that information could potentially be used to make phishing or impersonation attempts more convincing.
We recommend that customers and employees:
Reset your password: Customers who use a password to log into Thankyou Payroll will be required to reset their password when they next log in. If you have used the same password elsewhere, please change it on those accounts too.
Be alert to suspicious messages: Take extra care with unexpected emails, texts or calls claiming to be from Thankyou Payroll, IRD, your bank or another trusted organisation.
Do not share sensitive information: Never provide passwords, verification codes or other sensitive information in response to an unsolicited communication.
Verify changes independently: If you receive a request to change bank account details, confirm it using contact details you already know and trust rather than replying directly to the message.
If a request feels suspicious, stop and contact the organisation directly using independently verified contact details.
We have formally notified the Office of the Privacy Commissioner, as required by law. If you wish to lodge a complaint with the Privacy Commissioner, you can do so directly on their website.
Is my active Thankyou Payroll account and core system safe to use?
Yes. The incident was strictly confined to a third-party reporting tool (Metabase). Our core payroll and other information processing engine, primary databases and payment infrastructure were not breached. Once you complete the mandatory password update upon your next login, your account is fully secure and you can run payroll as normal.
Is payroll continuing as normal?
Yes. Customers' Thankyou Payroll accounts and our core payroll system were not accessed as part of this incident. Payroll services continue to operate without disruption.
Have any payments or payroll records been changed?
There is no reported impact on payroll operations. The third party did not access customers' Thankyou Payroll accounts or our core payroll system.
Are my payroll funding or money transfers affected?
No. The incident did not involve access to bank processing channels, funds transfer systems or financial accounts. All scheduled payroll payments, salary disbursements and PAYE tax transfers remain completely unaffected and will proceed on schedule.
Were my banking login details or credit card numbers exposed?
No. Thankyou Payroll does not store online banking passwords, banking credentials or credit card information. The reporting dataset contained only bank account numbers used for direct credit pay deposits.
Why am I being asked to reset my password?
We are requiring customers to reset their password as a precautionary security measure. Two-factor authentication is also in place to provide additional protection.
How do I verify if a communication claiming to be from Thankyou Payroll is legitimate?
Thankyou Payroll, Inland Revenue (IRD) and major banks will never contact you by phone, email or SMS to request your password, PIN, full bank account verification or IRD number.
If you receive a call asking for confidential information, hang up immediately.
If you receive an email with unexpected links or attachments, do not click them.
Verify any request by calling us directly on our dedicated support line using a phone number from our official website.
Do I need to contact Thankyou Payroll?
You do not need to contact us unless you have questions or concerns. If you receive a suspicious communication claiming to be from Thankyou Payroll, please do not respond or click on any links. Contact us directly using the details below.
Dedicated Contact & Support
If you have specific questions regarding your data or need technical assistance, our dedicated Incident Response Team is available to assist you.
Phone: +64 4 887 2217 (Monday – Friday, 9:00 AM – 4:00 PM NZST)
Email: privacyteam@thankyoupayroll.nz