What happened
In October 2022 the rental-property database of Harcourts Melbourne City, a Harcourts franchisee, was accessed by an unknown third party [harcourts-itwire], [harcourts-choice]. Harcourts said the access occurred after a representative of its service provider, Stafflink, used a personal device for work rather than a secured, company-issued one; Stafflink disputed this [harcourts-innov], [harcourts-choice]. The database held names, addresses, bank details and signatures of tenants, landlords and tradespeople, and photo identification for prospective renters [harcourts-innov].
Timeline
- 2022-10-24 — The unauthorised access was discovered [harcourts-itwire], [harcourts-choice].
- 2022-11 — Harcourts notified affected people and the Office of the Australian Information Commissioner [harcourts-innov].
Current status
Disclosed. Harcourts notified the OAIC. A count of affected individuals was not reported, so no figure is asserted here. This record concerns the Harcourts Melbourne City franchise.
Why it matters
Rental applications concentrate unusually sensitive identity documents — photo ID, bank details, signatures — so a single point of unauthorised access can expose them.