What happened
In September 2024 the catering and support-services company Compass Group (Australia) confirmed unauthorised activity on its network, detected on 4 September 2024, and said that some data had been taken, as reported by Cyber Daily [cg-cd]. The Medusa group claimed the attack and posted samples it says include employee wage declarations and identity-document scans; Compass has not confirmed the group’s involvement or those data types [cg-cd]. Compass notified the ACSC and OAIC [cg-cd].
Around 20 September 2024 Compass confirmed a second intrusion, on a server that had recently been brought back online, and said it had begun notifying people whose high-risk data was exposed [cg-cd2].
Current status
Disclosed. No count of affected people was published, so none is asserted here.
Why it matters
If the identity documents the group claims to hold are genuine, they are exactly what is used for fraud. This record covers a staff-data breach rather than a customer one — while the second intrusion shows the risk of bringing systems back online before recovery is complete.