The Charity's Own Computers Were Fine, and the Payments Stopped Anyway

Way Forward is a small Aussie charity that negotiates a person's several debts down into a single repayment plan that fits a realistic household budget, using funding from the major banks, who provided seed money in 2018. On 9 September it put a statement on its website saying it could not process its clients' usual payments, because of a cyber incident at the external provider that runs its customer management platform. Cyber Daily reported it the next day.

Nothing inside the charity's own walls was affected. Nobody there was phished, none of its passwords were guessed, and there is no ransom note with its name on it. The platform where payment arrangements are set up and managed belongs to somebody else, so when that company had an incident, the charity lost the ability to do the one thing it exists to do. Its online eligibility tool went down at the same time, and visitors were met with a message saying the system was currently down.

The consequences landed on the clients. Way Forward asked the creditors it works with to put a temporary payment moratorium in place, so that clients who fully intended to make their repayments would not have their credit reports marked down because the money could not move. Those clients are people already in financial hardship, and none of them chose the software or would be likely to recognise the provider's name.

The provider's early assessment, relayed by Way Forward, is that the affected information "relates mostly to the provider's own company". The charity has said it will contact individuals directly if its investigation finds their personal information was involved. That kind of early reassurance is normal and usually given in good faith, but it describes where the investigation began and is not a finding, so it is worth asking again in a month.

Update, October 2026: Five weeks after the incident, Way Forward's website still says the charity is currently unable to accept new clients, and it links to a separate notice about resuming payments for the clients it already has. Its original statement said those clients would be paid under interim arrangements until usual arrangements can resume, and it did not give a date for that.

Why this matters to your business

Most small businesses have moved onto other people's software over the last decade without ever treating that as a risk decision. The booking system, the practice management software, the payment gateway and the job scheduler have become the place where the business actually happens. You can have strong passwords, current patches and a sensible team, and still be unable to trade on a Tuesday morning because a company you have never dealt with is having a bad week.

Think of it as the cash-in-transit van. Your till is balanced, the shop is locked and the takings are bagged, but the van company's depot has been hit, so your money is sitting in somebody else's vault and nobody can say when it will move. In the meantime the wages, the rent and the supplier invoices still fall due, and the people you owe do not much care whose depot it was. Way Forward's own systems were fine and its clients' payments were stuck anyway, and five weeks on there is still no date for them to resume. A sensible business works out in advance which of its suppliers hold its money, its records or its customers, because those are the ones where a week of silence turns into a real problem.

Three things to actually do this week for reassurance

1. List the outside systems you cannot trade without. Write down each one, what it does for you, and how many days you could keep operating if it disappeared. The list is usually shorter than expected, and the days are usually fewer.
2. Find the manual fallback for your top two. If the booking system or payment platform vanished for a week, work out what the paper or spreadsheet version would be, who holds client contact details offline, and when you last took an export. A copy of your customer list that lives outside the platform is the cheapest resilience you can buy.
3. Put two questions to each critical supplier in writing. Ask how quickly they will tell you if they have an incident, and how long they take to restore service when their systems go down. A supplier who cannot answer either question by email has answered both. There is a ready-to-send email at the very bottom of this page.

By the numbers

• Breaches involving a third party: 48% of all breaches, up 60% on the previous year [Verizon Data Breach Investigations Report 2026]
• Cost of cybercrime to the average Australian small business: $56,600 AUD per incident, up 14% (covers all cybercrime types, not supplier outages alone) [ASD Annual Cyber Threat Report 2024-25]
• Small and medium businesses reporting a cyber incident in the past year: 1 in 5 [Australian Banking Association, reported by Cyber Daily, 1 September 2026]

Sources

• Exclusive: Not-for-profit Way Forward suspends payments following external cyber incident (Cyber Daily, 10 September 2026)
• Way Forward homepage (Way Forward)
• Statement from Way Forward re cyber incident (Way Forward, 9 September 2026)
• 2026 Verizon DBIR: third-party risk is now breach risk (Safe Security, 2026)
• Annual Cyber Threat Report 2024-25 fact sheet for businesses and organisations (ASD, October 2025)
• 4 in 5 SMEs report being exposed to scams (Cyber Daily, 1 September 2026)