In July 2021, the department became aware of a cyberattack on our login management system. The department immediately took steps to isolate the affected system and contain the breach. The system had a vulnerability which the department did not know about.

Since containing the data breach, the department has engaged forensic analysts, and undertaken detailed investigations to understand the scope of the breach and the risks arising from it. The department is also working with the Australian Cyber Security Centre, the NSW Information and Privacy Commissioner, and the NSW Police to investigate the attack.

We acknowledge the seriousness of this incident and apologise for the distress that a cyber incident causes to the community.

People whose information has been compromised in this incident will be contacted by the department. We’ve also established a call centre so that people who are affected can reach out to the department for support. If a person does not receive a notification, they do not need to take any further action regarding this incident.

People whose information has been compromised in this incident will be contacted by the department. If a person does not receive a notification, they do not need to take any further action regarding this incident.

The attack occurred in July 2021. The department’s Secretary, Georgina Harrisson notified the public in the days after the incident occurred.

The department’s IT and security teams detected the attack while it was in progress and ceased the transfer of data.

Immediately after the attack, the department commenced a forensic investigation of the data that was taken. That is an extremely complex and time-consuming process.

Anyone who receives a call from someone asking for personal information, and doubts the communication is genuine, should contact the relevant organisation using publicly listed details.

Regardless of whether you are affected by the data breach, Cyber Security NSW recommends that all NSW residents take steps to protect their personal information in the following ways:

• Wherever possible implement multi-factor authentication on online accounts e.g. get an additional code sent to your phone by SMS before you can log into your account.
• Never respond to unsolicited phone calls, emails or text messages.
• Scammers impersonate government and business to convince people to take action, often urgently. If you aren’t sure, do your own research and make contact using publicly listed contact details for the organisation
• Ensure anti-virus software is installed on all online devices and updated regularly.

For the latest information about known scams, visit scamwatch.gov.au