Northern Rivers Resilient Homes Program knowledge breach

The breach occurred when a former momentary worker of the RA uploaded knowledge containing private info to an unsecured Artificial Intelligence (AI) instrument which was not authorised by RA.

We perceive this information is regarding and we’re deeply sorry for the misery it could trigger for these concerned in this system.

We are contacting individuals at present to verify whether or not their info was affected or not and to supply personalised help.

Since studying in regards to the extent of this breach, we labored intently with Cyber Security NSW and engaged forensic analysts to undertake an investigation to know the scope and the dangers arising from it.

There isn’t any proof that any of the uploaded knowledge is publicly out there on-line or has been accessed by a 3rd social gathering at this stage.

Importantly, we will affirm that no driver’s licence numbers, Medicare numbers, passport numbers, or Tax File Numbers had been disclosed within the breach.

What we all know
Through exterior forensic evaluation, we have now confirmed:
• 2031 individuals who supplied private info in relation to the Northern Rivers Resilient Homes Program (RHP) had a few of their info concerned in a knowledge breach.

The info disclosed consists of common case info in addition to:
• Name and call particulars
• Residential/mailing handle
• Date of delivery
• Personal info
• Sensitive well being info
• Limited monetary commentary, however not banking or monetary particulars

What occurred?
Between 12 and 15 March 2025, private info was uploaded by a former momentary worker of the RA to the AI platform ChatGPT.

Once we understood the total scope of the breach, we took steps to comprise any additional dangers. We started working intently with Cyber Security NSW and engaged forensic analysts. We undertook detailed investigations to know what was shared, what the dangers had been and who from this system was impacted.

The knowledge shared was a Microsoft Excel spreadsheet with 10 columns and greater than 12,000 rows of data. All of it needed to be completely reviewed to know what might have been compromised.

The course of was extremely complicated and time consuming and we acknowledge that it has taken time to inform individuals. Our focus has been on ensuring we had all the knowledge we wanted to inform each impacted individual accurately.

We perceive that folks can have questions on how this might have occurred and why it has taken time to inform impacted individuals. We have initiated an unbiased overview of how this breach was recognized and managed and can share these findings as soon as it’s accomplished.

What we’re doing
With the help of ID Support NSW, we’re contacting individuals at present to verify what info has been affected and to supply personalised help. We are working with Cyber Security NSW to watch the web and darkish internet to see if any of the knowledge is accessible on-line. This evaluation might be ongoing. The NSW Privacy Commissioner has additionally been notified.

We have reviewed and strengthened inner programs and processes and issued clear steering to workers on using non-sanctioned AI platforms. Additional safeguards are actually in place to stop future incidents.

What help is offered?
We are working with Social Futures to achieve out to individuals who have been impacted and ID Support NSW, a authorities id and cyber safety help service, to help anybody whose knowledge might have been compromised.

ID Support NSW may help by offering personalised recommendation on shield or restore id safety and share choices for extra help and counselling companies.

To entry this free help, individuals ought to:
• Call ID Support on 1800 001 040 and supply the reference quantity included of their notification from us. The ID Support staff is offered Monday to Friday from 9am to 5pm, excluding public holidays. Interpreter companies can be found.
• Go on-line to to entry the breach portal. Enter the reference quantity to enter the portal.

What ought to individuals do?
• If anybody impacted desires to debate the precise kinds of their private info that had been concerned within the knowledge breach they’ll contact RA on (02) 9212 9212. Staff can be found Monday to Friday from 9am to 5pm, excluding public holidays.

• We encourage anybody impacted to repeatedly verify bank card and financial institution statements for uncommon transactions. Anyone impacted can ask for a brief ban on playing cards or accounts in the event that they detect uncommon exercise and suspect fraud. Anyone impacted can cancel or droop the cardboard and request a brand new card if there are unauthorised transactions or transfers.

• We are additionally encouraging everybody to stay vigilant of scammers and to stay alert, particularly with e mail, textual content messages or phone calls and to make use of two-step authentication for private e mail accounts and different on-line accounts.

• We are asking individuals to not share private info over the cellphone until they’re sure about who they’re sharing it with. And in the event that they discover suspicious entry to e mail accounts and different on-line accounts, they need to reset passwords for his or her accounts.

We will proceed to share updates and supply help to those that have been impacted.

We perceive the seriousness of this breach and are deeply sorry for the potential influence on individuals whose private and delicate info has been disclosed.

We stay totally dedicated to defending their privateness and restoring belief within the Resilient Homes Program and the NSW Reconstruction Authority.

For extra info, go to nsw.gov.au/RHPdatabreach