What happened
In February 2024 the records-management supplier ZircoDATA disclosed a ransomware incident affecting its systems. It said it notified the ACSC, the AFP and the OAIC [zd-idm]. In March 2024 ZircoDATA said there was no evidence that customer personal information had been affected [zd-idm].
In May 2024 the National Cyber Security Coordinator disclosed that the incident affected government and other clients [zd-itnews]. Affected client organisations then confirmed exposure of their data — including archived family-violence and sexual-assault support records held for Monash Health [zd-itnews], student identity data for Melbourne Polytechnic [zd-itnews], and identity and visa data from the Home Affairs Free Translating Service [zd-cd]. Victoria’s information commissioner (OVIC) told affected Victorian public-sector bodies to notify it [zd-itnews].
Timeline
- 2024-02-08 — ZircoDATA discovered the encryption of its systems [zd-idm].
- 2024-02-22 — ZircoDATA learned of a dark-web claim relating to the incident [zd-idm].
- 2024-02 — ZircoDATA publicly acknowledged the incident [zd-idm].
- 2024-05 — The National Cyber Security Coordinator disclosed impact on government and other clients; Monash Health confirmed its records were affected [zd-itnews].
- 2024-10 — Home Affairs personal data reported as compromised [zd-cd].
Current status
Disclosed. As a supplier incident the exposure spans many clients; no single count of affected individuals has been published, so none is asserted here.
Why it matters
A records-management vendor concentrates other organisations’ most sensitive archives; one breach can expose government and health data across unrelated clients at once.