What happened
In March 2023 the Tasmanian Government was caught in the global GoAnywhere file-transfer breach exploited by the Cl0p group, exposing data held by its education department [tas-itnews], [tas-record]. The Tasmanian Government said about 150,000 individuals and businesses were affected, while roughly 16,000 documents were actually leaked to the attacker’s site [tas-record], [tas-itnews]. Reporting said names, addresses, invoices and bank account numbers were involved [tas-record-0407], along with children’s names, homerooms and year levels, and dates of birth for some TasTAFE students [tas-itnews].
Timeline
- 2023-03-27 — Cl0p added the Tasmanian Government to its leak list [tas-record-0407].
- 2023-04-05 — The Minister acknowledged data may have been accessed [tas-record-0407].
- 2023-04-07 — Leak of about 16,000 documents confirmed [tas-record-0407].
- 2023-04-10 — Government detailed the documents leaked [tas-itnews].
Current status
Disclosed. The 150,000 figure counts individuals and businesses (not solely people), and the 16,000 is a document count — so no clean count of affected people is asserted here [tas-record], [tas-itnews]. No regulator action has been reported.
Why it matters
Children’s data is among the most sensitive a government holds, and this incident shows how a single file-transfer vulnerability cascaded into a whole education system.