Kaye-Smith Security Incident FAQ

Kaye-Smith – a leader in the execution and management of business-critical communications in the Pacific Northwest and a service provider to World Vision, informed us on June 13^th, 2022 that your personal data was potentially involved in a cyberattack. The following FAQs are here for your reference.

June 2nd, 2022: Kaye-Smith is the subject of a ransomware attack that locks certain Kaye-Smith systems. Kaye-Smith’s cybersecurity team and forensics experts go into action to contain the attack, eradicate the attacker, and restore secure operations.
June 13th, 2022: Kaye-Smith informs World Vision that they have seen file names indicating that World Vision’s data could be amongst files accessed by the attacker.

Kaye-Smith is a leader in the execution and management of business-critical communications in the Pacific Northwest and a service provider to World Vision. They handle the printing and mailing of receipts, monthly statements, service-related communications, and order fulfillment mailings.

Kaye-Smith has not completed its investigation to positively confirm which donors were impacted by the data breach. We have chosen to send out a notification now because we believe there is a high likelihood that your name was part of the data breach and wanted you to be aware of this. Please see #5 “What information was exposed?” and #11 “What should I do to protect myself”.
Kaye-Smith used several measures to protect your data. Kaye-Smith has seen no evidence, and has no reason to believe, that any data was or will be made available publicly. As a precautionary measure, Kaye-Smith has hired outside experts to monitor the web and they have found no evidence that your data was released or misused.
No World Vision donor credit card information, no bank account information, and no Social Security numbers were involved in the data breach.

We do not plan on sending out further notification, unless the investigation uncovers new information that is substantially different than what we know today. We will reassess whether a further notification is needed at that point, but we believe that is highly unlikely.

Donor account number, first and last name, mailing address(es), how long you’ve been a World Vision donor, and current year and prior year giving amounts were potentially involved in the breach.

No. But please be extra careful if you receive any unsolicited communications, particularly if they claim to be from World Vision or Kaye-Smith. Please note that World Vision will never contact you unprompted to ask for your account details or security information, and they will never ask you to disclose your passwords. It’s always a good idea to contact World Vision directly if you have any reservations about an unprompted communication.

Yes, Kaye-Smith has conducted a thorough investigation, which involved partnering with law enforcement and independent forensics experts to investigate this matter.

Kaye-Smith has obtained deletion of the World Vision data impacted by this attack. Appropriate security measures have been taken to protect the data while the Kaye-Smith team analyzes it for breach notification purposes. The Kaye-Smith forensics team is monitoring for any signs of customer data being transferred or sold and has so far found no evidence of this.

Kaye-Smith: Kaye-Smith teams have identified and implemented several security improvements to limit a similar attack in the future.
World Vision: World Vision’s security team has reviewed Kaye-Smith’s technical response and believe that they have responded appropriately.

Yes, Kaye-Smith experienced a ransomware attack. Ransomware is a type of cyber-attack through which a cybercriminal prevents users from accessing their system or personal files. Cybercriminals often steal data before preventing system access as a second way of leveraging ransom payment from their victims.

Please be extra careful if you receive any unsolicited communications, particularly if they claim to be from World Vision or Kaye-Smith. Please note that World Vision will never contact you unprompted to ask for your account details or security information, and they will never ask you to disclose your passwords. It’s always a good idea to contact World Vision directly if you have any reservations about an unprompted communication.