Ransomware attack behind offline parking app around the country

9:33 pm on 11 March 2020

A parking app used by several New Zealand councils has gone offline, with councils scrambling for a quick fix amid social media backlash.

The PayMyPark app has been down for a couple of days at a number of councils around the country.

The PayMyPark app has been down for a couple of days at a number of councils around the country. Photo: Supplied / Stuff

The PayMyPark smartphone app was this week flagged as "experiencing technical issues" in Marlborough, Christchurch, Wellington, Dunedin, Waitaki, Hutt and Tauranga.

Its website returned a "Error 404" message and the PayMyPark app was "not found" on the Google Play store. It was still available on the Apple app store, but recent reviews said it was a "real pain" as it often "failed to download data" and "suddenly [stopped] working".

A Marlborough District Council spokesman said the council had been in touch with the app's parent company, Arthur D Riley & Co Ltd (ADR), but were still unsure why the app was not working.

ADR managing director Garth Mickell told Stuff on Wednesday the company was a victim of a ransomware attack.

The company commissioned the PwC Cyber Response Team to carry out a thorough investigation as soon as it was notified, Mickell said.

"As a result of this ongoing investigation, we believe we have identified how this attack occurred and have taken steps to get PayMyPark back online.

"We want to assure all our customers and users that we have not identified any breach of private or personal information or data as a result of this ransomware attack."

PayMyPark did not hold credit card or other personal financial information, Mickell said.

He thought the PayMyPark app would be up and running again by 6am on Thursday.

Marlborough resident Mark Shaw, who had worked in digital spaces for over two decades, said he and his "geek mates" suspected the app had been hacked.

"When you get an 'Error 404' message on a website, it means they've taken down everything on it. It's all gone," he said.

Shaw wired $100 to the app last Friday, which he intended to use to pay his parking for the next month, before the app was pulled.

"Where's my money? I don't want to pay for parking again," he said.

"If I was on the breadline, and I didn't have my money for parking anymore, what do I do? There will be people like that in this."

He was originally drawn to the app as it was "cheaper" than meters.

"It was actually really good. I didn't have to go to the machine and put it [money] all in ... And I didn't have to buy an annual pass. It was, for me, great. The app worked just fine until Monday," he said.

"Seems a bit concerning that no statement has been released and the rumour is they've been compromised. They have my money as well as my personal data #paymypark," Twitter user @winegeeknz said.

"I'm aware it's down and affecting multiple councils. Speculation is the whole platform was hacked and the silence from everybody seems to suggest this could well be the case. If this has occurred and data has been breached when will people be told?" Twitter user @stevebiddle said.

Hacking rumours were also discussed on GeekZone, an online technology community.

"There has been talk the whole platform was hacked or compromised in some way, but it's just that - talk... But when nobody will say anything it does make you wonder," one user said.

"Rumour is they might have been hacked," Twitter user @maknz said.

A Wellington City Council spokesman said on Wednesday morning that there was a "significant problem" with the parking app.

"We [the council] are meeting with the company that runs the app this afternoon to figure out how long it's going to take to get it back up and running, and what's going on," the spokesman said.

It said on its Facebook page on Tuesday that app users could appeal "unlikely" parking infringement tickets, once the app was back online.

When calling the Wellington City Council's contact centre, an automated message said: "Our parking system is currently experiencing technical issues. We're working on a fix but in the meantime please use the parking meters to pay for parking."

The Hutt City Council Facebook page said the app troubles were a "widespread problem across most local authorities".

"Our provider is working on a fix," the council said on Tuesday.

The Dunedin City Council said in comments on a Facebook post, which announced the app was unavailable, that someone had attempted to breach the app's website.

"Due to the security systems in place, no personal information or credit card details were accessed. Cyber security specialists were called in and as a security measure, the site and app were taken offline. They are working to get the site and app back online as a high priority."

A Facebook user on a Dunedin City Council post said she found out the app was down when she went for a hospital appointment on Tuesday.

"Very frustrating, lucky I had some coins on me!!"

A Christchurch City Council spokesman said on Wednesday they did not know what had caused the app to go offline.

no metadata

Local Democracy Reporting is a public interest news service supported by RNZ, the Newspaper Publishers' Association and NZ On Air.