This statement provides an update on a data breach that occurred in November 2023, and the NDIA's response to date. It does not relate to a new or different event.
Since the release of its statement on 28 November 2023, the NDIA has continued to investigate the data breach and to work alongside the Australian Federal Police, the NDIS Quality and Safeguards Commission and other relevant government agencies and law enforcement authorities to respond to this matter.
Why are we publishing this statement?
The NDIA has an obligation, under the Privacy Act 1998 (Privacy Act), Notifiable Data Breaches Scheme (NDB Scheme), to notify any individuals potentially impacted by this breach. The Agency has worked to do this, but has been unable to contact some individuals who, at the time of their or their nominee's engagement with the Scheme, were under the age of 18.
These individuals are not NDIS participants, but may be either a former participant, related to a current NDIS participant or someone who had previously applied for access to the Scheme.
As previously communicated, the information of these individuals that was disclosed during the data breach involved the following details recorded in the NDIA's system, including:
- full name
- date of birth
- gender
- address, including postcode.
We would also like to reassure everyone that this incident will not impact any participant's ability to receive services and that participants can continue to receive their disability supports in the usual way.
The NDIA is continuing to actively monitor the situation and investigate the breach. It should be noted there are active prosecutions before the courts in relation to this breach, following the Agency and Fraud Fusion Taskforce taking action against those allegedly responsible.
The NDIA recognises that this news may be distressing and concerning for participants, families, carers and supporters. We sincerely apologise for this.
What can you do?
If you suspect that you or someone you know falls within the category of persons identified above, we recommend you take, or advise the person you know to take, the following actions to help reduce the risk of harm associated with the unauthorised disclosure of personal information:
