What happened
In November 2023 the National Disability Insurance Agency disclosed an insider breach in which a staff member accessed and leaked participants’ personal details — names, dates of birth, gender and addresses [ndia-detects], [ndia-co], [ndia-itnews]. The NDIA said it believed the incident was financially motivated [ndia-itnews]. The staffer was arrested and charged following an investigation by the NDIA-led Fraud Fusion Taskforce, and was sentenced in Parramatta District Court on about 5 May 2025 to an aggregate 2.5 years’ imprisonment served by Intensive Corrections Order, 300 hours’ community service and a $4,000 fine [ndia-sentenced]. The NDIA reported that a provider who received the data was also later sentenced [ndia-provider-sentenced]. This is distinct from the June 2023 HWL Ebsworth breach.
Current status
Resolved through prosecution [ndia-sentenced], [ndia-provider-sentenced]. The exact number of participants affected was not published, so none is asserted here.
Why it matters
Disability-scheme records are highly sensitive, and an insider misusing legitimate access is a distinct threat from an external hack — controls have to guard against both.