Security Update

We are providing an update on steps taken by Summ (formerly Crypto Tax Calculator) since becoming aware of a potential sophisticated phishing scam targeting our customers, which we identified as a result of a cyber incident against our third-party provider.

Since our last update, we have been working with a team of external experts to investigate. We have also notified Australian privacy regulators with the required details and the outcomes of our investigations.

Our investigation confirmed there was unauthorised access into Summ’s system. General information was exposed such as user IDs, email addresses and password hashes; and in some instances, chat logs, public blockchain wallet addresses, and cryptocurrency exchange names. Some internal administrative Summ information was also exposed.

This information does not allow access to or transfer of funds via your cryptocurrency exchanges or blockchain wallets. Summ only manages the record keeping obligations of its users, and funds cannot be accessed through our platform. Furthermore, Summ does not collect government-issued identity documents, nor will we ever ask users for private keys, write-access exchange API keys, or to sign a wallet transaction that could enable the transfer of funds.

The accessed information may increase the risk of exposure to a potential sophisticated phishing scam attempting to trick users into releasing further information.

At this stage, Summ has no information to suggest this has happened. Summ strongly recommends all users remain vigilant and adhere to the following security measures:

• While all Summ user passwords are secured with robust one-way encryption, we recommend that all users still adopt a best practice approach to the security of your passwords. This includes rotating your password on Summ and other platforms, and the utilisation of a password manager.
• Make sure you do not share private keys or write-access API keys with unknown third parties. As a reminder, Summ or affiliated sites will never ask you for private keys, write-access exchange API keys, or to sign a wallet transaction which allows for transfer of funds.
• Check all URLs to ensure it is the website that you are intending to visit.
• Remain vigilant and validate all communications from Summ. For any suspicious or unauthorised activity, report this to security@summ.com and we will promptly review it.

In response to this incident Summ has taken steps to reinforce the integrity of our systems and no further illegal activity has been detected. The Summ platform remains safe, secure and accessible for its users.

Summ sincerely apologises to all users for any concern or inconvenience this may have caused.

We are committed to the highest standards of security and data integrity and encourage all users to remain vigilant and adhere to the steps outlined above to preserve data security.