What happened
In March–April 2020 phishing attacks compromised 47 Service NSW staff email accounts, exposing personal information belonging to around 104,000 customers held within those mailboxes — about 730 GB of data and 3.8 million documents [servicensw], [nsw-audit]. Service NSW initially put the figure at about 186,000 before revising it to about 104,000 in February 2021 [servicensw]. The Audit Office of NSW later conducted a performance audit of the agency’s handling of personal information [nsw-audit].
Timeline
- 2020-03 — Staff email accounts compromised via phishing; the Audit Office describes two attacks in late March and early April 2020 [servicensw], [nsw-audit].
- 2020-05-14 — Breach announced publicly [nsw-audit].
- 2020-09 — Initial estimate of ~186,000 affected customers released [nsw-audit].
- 2020-12-18 — Audit Office of NSW performance audit report published [nsw-audit].
- 2021-02 — Figure revised to ~104,000 customers [servicensw].
Current status
Disclosed. The NSW Information and Privacy Commission was kept informed; no regulator finding about this incident has been published, and the Audit Office’s performance audit is not a regulator finding [nsw-audit]. Figures are as published by Service NSW. [servicensw]
Why it matters
A reminder that a handful of phished mailboxes can expose large volumes of citizens’ data held in everyday email.