What happened
In May 2024 a website run by an anonymous group posted what it claimed was data collected by Outabox — a vendor that supplies sign-in and facial-recognition systems to clubs and pubs. The site claimed to hold records on more than a million people who had signed in at NSW venues (ACS listed 19 venues; ClubsNSW said 16 clubs). The site claimed the data included facial-recognition biometrics, driver licence scans, signatures, home addresses, dates of birth, club membership details and gaming-machine usage; these claims could not be independently verified [outabox-acs], [outabox-reg]. Outabox called the site “malicious” and said it contained “false statements” [outabox-acs].
Timeline
- 2024-05-02 — Reports emerged that patron data had been posted to a leak site by people claiming to be Outabox subcontractors; that claim could not be independently verified [outabox-acs], [outabox-reg].
- 2024-05 — Outabox acknowledged a potential breach; NSW Police opened an investigation [outabox-acs], [outabox-reg].
- 2024-05 — NSW Police arrested a 46-year-old Sydney man, who was charged with blackmail (demand with menace) and bailed to appear at Fairfield Local Court [outabox-acs-arrest].
Current status
Under police investigation; a charge is before the courts and no outcome has been found. No official or company figure for the number of people affected exists, so none is asserted here — the “more than a million” figure is the leak site’s own unverified claim [outabox-acs-arrest]. The origin of the leak — a purported unpaid-subcontractor dispute — remains unverified [outabox-acs].
Why it matters
If the claims are accurate, this is one of Australia’s most significant biometric-data exposures: facial-recognition templates and licence scans cannot be reissued like a password, and the incident sharpened the national debate over how venues collect and store biometric identity data.