What happened
On 5 December 2023 Nissan Oceania detected a cyber attack that exposed the personal information of around 100,000 people across Australia and New Zealand [securityweek-nissan], [register-nissan]. According to the company-stated figures, up to about 10% had government identification taken — approximately 4,000 Medicare cards, 7,500 driver licences, 220 passports and 1,300 tax file numbers — while for the remaining ~90% other personal information such as loan transaction statements, employment and salary details and dates of birth was involved [nswgov-nissan]. Nissan began notifying affected individuals in March 2024.
Timeline
- 2023-12-05 — Cyber attack on Nissan Oceania systems detected [securityweek-nissan].
- 2024-03 — Public disclosure; ~100,000 people to be notified across AU & NZ [nswgov-nissan], [register-nissan].
Current status
Disclosed; affected individuals notified with identity-protection guidance [nswgov-nissan]. The ~100,000 figure is company-stated and Nissan said the final count may be lower after de-duplication [securityweek-nissan].
Why it matters
A trans-Tasman breach exposing government identity documents — the category of data that carries the highest downstream fraud risk.