The personal details of more than 4,000 government employees have been exposed in a massive data breach of 50,000 staff records from various companies across Australia.
The leak, first reported by iTnews, is believed to be the second-largest data breach in Australian history, after the details of 550,000 blood donors were accidentally leaked by the Red Cross in 2016.
3,000 employees at the Department of Finance, 1,470 at the Australian Electoral Commission and 300 at the National Disability Insurance Agency had their personal records left openly accessible after a third-party contractor misconfigured an Amazon S3 bucket – a commonly used form of cloud storage.
The information included credit card numbers and passwords of some employees, as well as full names, phone numbers and email addresses. Some records also contained details of staff salaries and expenses.
Insurance company AMP was the worst affected, with 25,000 staff records exposed.
Utilities and construction company UGL had 17,000 records affected, while Rabobank had 1,500.
The breach was discovered by a Polish security researcher known as Wojciech, with iTnews reporting that most of the credit card numbers were out of date or cancelled.
The Department of Prime Minister and Cabinet told iTnews that they had known of the breach since early October.
“Once the Australian Cyber Security Centre became aware of the situation, they immediately contacted the external contractor and worked with them to secure the information and remove the vulnerability,” the department said.
“Now that the information has been secured, the ACSC and affected government agencies have been working with the external contractor to put in place effective response and support arrangements.”
AMP said no customer data had been compromised in the leak and the data related to “internal staff expenses”.
“We confirm that a limited amount of company data ... was inadvertently stored in a publicly available cloud service by a third-party supplier,” a spokesman said. “The mistake was quickly corrected once identified and the matter investigated to ensure all data had been removed.
“AMP treats data security very seriously and has strict policies in place regarding the handling of data with third-party vendors. We are reviewing the situation to ensure standards are maintained.”
On Thursday, the Victorian Electoral Commission also confirmed that the details of 21,000 Melbourne residents and 28 silent electors had been accidentally published online.
The data, compiled for a 2005 local council election, had been uploaded by the Proportional Representation Society of Australia, and was accessible through a search engine, but has since been taken down.
