SecurePay security issue triggered NAB Transact outages

Almost two months of service issues with NAB's secure online payments gateway Transact were triggered by a security issue in Australia Post's SecurePay environment, iTnews can reveal.

NAB has struggled since April 27 to stabilise Transact from consistent log-in issues, timeouts, transaction errors and problems with batch processing.

Transact is a customised version of Australia Post's SecurePay and is used by retailers to accept online payments securely.

Both Australia Post and NAB have declined to detail what has caused the ongoing outages and stalled services over the past two months.

However, iTnews can reveal a security threat within SecurePay in late April triggered the cascading service problems.

IP Australia is a customer of NAB Transact and was forced to revert to an entirely manual solution after the platform became unusable. 

It set up an emergency fax line to continue processing customer payments until the system and its own eServices portal could be stabilised, and was only able to switch its portal back on last Friday.

IP Australia's general manager of business improvement and support centre, Rob Bollard, told iTnews services fell over after SecurePay took steps to quickly upgrade its security posture upon identifiying a security issue on April 27.

He said SecurePay re-routed transactions to allow for better control and management of transaction processing and heightened monitoring of transactions for unusual activity, among other things.

The changes resulted in latency issues which created a database lock-up as well as problems with batch processing.

He said SecurePay had only performed light testing of the changes before implementing them into the production environment due to the urgency of the situation.

"This testing resulted in further issues to the merchant version IP Australia uses," Bollard said.

SecurePay then attempted to introduce further security upgrades to protect NAB Transact as a priority, which resulted in another outage.

"The platform has been relatively stable since Friday the 12th of June and our teams continue to monitor the service closely," Bollard said.

Bollard did not identify the specific security issue. NAB referred iTnews to Australia Post for comment. The organisation declined to comment.

NAB executives Mark Adams and John Murphy apologised to customers for the "frustrating" experience in an open letter in early June.

"We want to ... assure you that the team at NAB is doing everything we can to fix this. Resolving this issue is an absolute priority for us," they wrote.