Has my supplier been breached?

“In early 2021 Transport for NSW was caught in the worldwide Accellion file-transfer (FTA) breach.”

“In December 2020 a third-party file-transfer application (Accellion FTA) used by the Reserve Bank of New Zealand was illegally accessed, exposing commercially and personally sensitive information held in that service .”

“NSW Health confirmed in June 2021 that identity information — and in some cases health-related personal information — was contained in files accessed during the global Accellion file-transfer breach, though its medica…”

“Have I Been Pwned and media reports named the email-marketing platform ActivePipe as the alleged source.”

“In May 2022 CTARS, a cloud client-management software provider used across the disability and NDIS sector, was breached and a sample of data was posted to a dark-web forum , .”

“In November 2021 Frontier Software, the external payroll provider used by the South Australian Government, was hit by ransomware.”

“In March 2023 the Tasmanian Government was caught in the global GoAnywhere file-transfer breach exploited by the Cl0p group, exposing data held by its education department , .”

“The company said the access occurred through two user accounts on HotDoc, a third-party appointment-booking platform .”

“In April 2023 the national law firm HWL Ebsworth was hit by the ALPHV/BlackCat ransomware group .”

“On 30 November 2022 Mercury IT, a Wellington managed-service provider, was hit by a ransomware attack that affected downstream organisations .”

“Reports suggest the cause was a vulnerability in Metabase, an open-source business-intelligence platform .”

“In May 2024 a website run by an anonymous group posted what it claimed was data collected by Outabox — a vendor that supplies sign-in and facial-recognition systems to clubs and pubs.”

“In mid-2018 PageUp, a recruitment and HR software provider used by many large Australian employers — banks, retailers, government and media — disclosed unauthorised access to its systems .”

“In mid-2020 records from ProctorU, a US-based online exam-proctoring service, were published on a hacker forum .”

“In mid-2024 Ticketmaster disclosed a breach of a third-party cloud database (part of the wider Snowflake-related campaign that hit many companies) .”

“Harcourts said the access occurred after a representative of its service provider, Stafflink, used a personal device for work rather than a secured, company-issued one; Stafflink disputed this , .”

“In February 2024 the records-management supplier ZircoDATA disclosed a ransomware incident affecting its systems.”