What happened
In early 2021 Transport for NSW was caught in the worldwide Accellion file-transfer (FTA) breach. TfNSW said some information was taken, and that its driver-licence and Opal systems themselves were not accessed [tfnsw-co], [tfnsw-itnews]. iTnews, citing a TfNSW notification email, reported that files on the Accellion appliance included driver-licence information, names, addresses and contact numbers belonging to both customers and employees [tfnsw-itnews].
Current status
Disclosed. iTnews reported that at least 500 customers and employees were impacted, but it is unclear whether that is the total [tfnsw-itnews]. No official total was published, so none is asserted here.
Why it matters
A single vulnerable file-transfer appliance exposed government-held identity data — the same Accellion event that hit organisations worldwide, including the Reserve Bank of New Zealand.