Wise ehf., which hosts the financial system Dynamics 365 Business Central, was attacked by an international criminal group on December 21, 2024, and copies of the company’s data were taken. Wise provides VR with services and hosts the union’s financial records.
Following the attack, Wise’s security plan was activated and the company worked to ensure safety and reduce the impact of the attack. Leading specialists from the cybersecurity company Syndis were brought in to help gather information on the scope of the attack, assess the situation, and strengthen defenses against further attacks. The Icelandic Data Protection Authority was notified of the attack in accordance with applicable regulations.
The same criminal group that gained access to Wise’s computer systems has attacked large corporations and governments around the world and used the most difficult attack methods to defend against—namely, targeting individual users. Follow-up investigations by Wise have revealed that the possibly copied VR data has neither leaked nor been sold. There are no indications that this will change in the future.
Information on VR data
Information from VR data that was possibly copied in the attack pertains to applications to the VR Holiday Fund and the VR Sick Pay Fund during the period from January 1, 2021 to December 21, 2024. This information includes:
- National ID number
- Name
- Home address
- Postal code
- Municipality
- Bank information (bank number, ledger, account number)
- Amount, VR Sick Pay Fund
- Type of payment, VR Sick Pay Fund (e.g. sickness per diem payments, death benefits, IVF treatment)
- Amount, VR Holiday Fund
- Payment date, Holiday Fund
- Information on what was purchased/booked on the holiday website (e.g. holiday homes, Icelandair gift cards)
- Booking date
We note that information on the type of payment from the VR Sick Pay Fund includes whether it is a sickness per diem payment, death benefit, or grant. There are two types of grant explanations: grants for IVF treatment and grants for travel expenses. Other more detailed health information about VR members is not stored by Wise, neither individuals’ medical certificates for sickness per diem payments nor the reasons for such payments or their duration.
We encourage VR members to contact us if they have further questions. Inquiries can be sent to the VR Data Protection Officer at personuverndarfulltrui@vr.is.
We apologize for any inconvenience this may cause and thank VR members for their patience.