What happened
In May 2025 the Australian Human Rights Commission disclosed that a web-form misconfiguration had exposed around 670 documents, roughly 100 of which were accessed via search engines [ahrc-co], [ahrc-cd]. The AHRC said the affected attachments were uploaded from 24 March 2025 and were accessed from 3 April [ahrc-co]. The documents could contain names, contact details and, in some cases, health information, schooling, religion and photographs [ahrc-co].
Timeline
- 2025-03-24 — Earliest upload date of affected complaint attachments, per the AHRC [ahrc-co].
- 2025-04-03 — Documents first accessed, per the AHRC [ahrc-co].
- 2025-05-13 — AHRC published its data breach notification [ahrc-co].
Current status
Disclosed. It was an accidental exposure, not a malicious attack; the AHRC notified the OAIC [ahrc-co]. The AHRC said the number of individuals affected was still being assessed, so none is asserted here. Separate media reporting suggested attachments may have been exposed since October 2021 [ahrc-itnews]; the AHRC has not confirmed this, so the record uses the AHRC’s dates.
Why it matters
People bring sensitive personal circumstances to a human-rights body in confidence; an accidental exposure of that material — some of it indexed by search engines — is a serious trust failure even without an attacker.