- Exclusive
- Technology
- Cybersecurity

This was published 5 months ago

# How this small non-profit group beat a malicious cyberattack

##### By David Swan

UN Women Australia says it has successfully repelled a malicious cyberattack, after hackers attempted to commit credit card fraud against the small non-profit organisation.

The Sydney-based group, founded in 2010, is focused on ending gender-based violence and promoting women’s economic empowerment, particularly across the Asia-Pacific. It funds its programs through public and private donations, as well as merchandise sales.

Late last year, UN Women Australia was hit by a bot-driven banking identification number (BIN) attack that disrupted its operations and forced it to close its donations and payment gateways.

BIN attacks are automated breaches used to guess a valid combination of a credit card number, expiration date and card verification numbers to determine if a card is active and vulnerable to fraud. The perpetrators racked up tens of thousands of dollars in bank fees for UN Women Australia and the organisation could only accept payments manually.

Organisations are often loath to publicly disclose that they have been targeted in a cyberattack, but UN Women Australia chief executive Simone Clarke said she wanted to help spread the message that they can happen to any organisations of any size, and at any time.

“When we saw thousands of hits directed against our servers, we felt incredibly vulnerable,” Clarke said.

“It was a perfect storm of potentially significant impact to the organisation. Individual donors and supporters interact with us online. We’re still only a fairly young organisation, but for us protection of our data is absolutely critical.”

Going through the ordeal was stressful and confronting for Clarke, who contacted the organisation’s various technology partners to try to fix the situation.

“Like any organisation, we’ve got a range of IT providers, everyone from payment gateways to CRM [customer relationship management] providers, and all of them have a different range of security measures in place.

“When you look at your tech stack, because we’ve got such a range of partners, what we found was a lot of passing the buck. So, our challenge was really everyone saying ‘that’s not our problem’ and getting bounced around.

“That’s where Cloudflare came in, they were recommended to us by one of our providers, and they helped us navigate through it, it was pretty invaluable.”

Cloudflare’s “Project Galileo” offers vulnerable targets such as artistic groups, humanitarian organisations, journalists and political dissidents free cybersecurity protection.

Cloudflare took on UN Women Australia’s cybersecurity responsibilities and began with an analysis of its technical infrastructure to locate the point of failure, before switching its payment gateway to one with better security.

Statistics provided by Cloudflare show that of its Project Galileo participating organisations, only 36 per cent have a dedicated individual managing cybersecurity, and 46 per cent have a staff headcount of between one and 10 employees.

“Especially for an organisation as small as ours, you’re only as good as your partners and whoever you’re working with,” Clarke said. “I’d had no experience of what a BIN attack was, and we’ve now got a renewed diligence around making sure that we are absolutely on top of it.”

Clarke said that, thankfully, no customer or donor data was impacted.

According to the Australian Signals Directorate – the government agency responsible for information security – more than 127,000 hacks against Australian servers were recorded in the 2022-23 financial year, an increase of more than 300 per cent on the same period a year earlier.

*The Market Recap newsletter is a wrap of the day’s trading. **Get it each weekday afternoon**. *