On Monday, 13th May, Sumo experienced an incident where data, including personal information, was accessed through a third-party storage system. Please be assured that this was not a compromise of Sumo’s systems. The issue was identified and rectified immediately.
Our investigations have not been able to conclude whether your personal information was accessed by an unknown person, but it may have been. We deeply apologise for this incident. If your personal information was accessed, you will have received an email or a letter with next steps and how you can protect yourself. All of the information about you which has been potentially accessed is listed in the letter.
What have we done and what are we doing about this?
Data protection is extremely important to us. We have investigated and assessed the incident and have reported it to the Office of the Australian Information Commissioner as well as the Australian Cyber Security Centre. We have successfully taken steps to remove any information available on the internet, that we are aware of.
Sumo has partnered with IDCARE, Australia’s national identity and cyber support community service. They have expert Case Managers who can work with you in addressing concerns in relation to personal information risks and any instances where you think your information may have been misused. IDCARE’s services are at no cost to you. If you wish to speak with one of their expert Case Managers, please complete an online Get Help form at www.idcare.org and one of their case managers will call you back. When engaging IDCARE please use the referral code SUMPWR24.
To help protect yourself, additional information including important things to understand and steps you can take is available on a dedicated Sumo incident web page hosted by IDCARE at https://www.idcare.org/sumo-incident-response
For additional information on protecting your privacy you can also visit the Australian Cyber Security Centre’s website or Scam Watch.
If after using these services you still have questions, We will assist with any queries or concerns you may have about this incident. To contact us, please email us at dataenquiry@sumo.com.au or call us on 03 9102 8494
FAQ’s
How will I know if my data has been accessed
If your personal information was accessed, you will have received an email or a letter (if we do not have your email on file) detailing what types of personal information were impacted and what support and advice we are providing.
Are Sumo’s systems safe to use?
Yes, Sumo’s systems are safe to use and were not compromised in the incident. Sumo is regularly monitoring its systems and the web for any suspicious activities.
What can I do to protect myself?
You can take some practical proactive steps to protect yourself. We recommend that you check the following websites for tips on protecting your personal information and other relevant information:
- IDCARE’s Sumo incident response page: https://www.idcare.org/sumo-incident-response
- Privacy Commissioner’s tips on protecting privacy: https://www.oaic.gov.au/privacy/your-privacy-rights/tips-to-protect-your-privacy/
- The Australian Cyber Security Centre
- You can also find out more about identity theft at https://www.scamwatch.gov.au/