Free tool · Updated weekly
The Australian data breach tracker.
A running list of the data breaches, ransomware attacks and extortion cases hitting Australian organisations. Search it, filter it, and see which sectors and groups are most active right now.
Each entry is checked before it appears here. Where an incident is only an attacker's claim and the organisation has not confirmed it, we label it as claimed rather than reporting it as fact.
68
Incidents tracked
12
In the last 30 days
Healthcare
Most affected sector
The Gentlemen
Most active group
Checking on your own organisation? This list only shows what has been disclosed. We can search the dark web for your domain and tell you what is already out there.
Campbelltown Anglican Schools Council in Sydney's west says it is investigating a cyber incident involving an unauthorised third party, after The Gentlemen ransomware group listed St Peter's Anglican School on its leak site on 14 October. The council has notified the ACSC and OAIC and informed parents and staff.
- Threat actor
- Attack type
- Ransomware
Data exposed
Student personal information (potentially)
LockBit has listed the Sunshine Coast accounting and advisory firm on its leak site with a countdown to 25 October. Poole Group confirmed a cyber incident affecting part of its IT environment and says it has notified the OAIC, ACSC and ATO while it assesses the scope.
- Threat actor
- Attack type
- Ransomware
The Qilin group listed the Smithfield, NSW switchboard manufacturer on 4 October and has since published what it says is the full dataset. Cyber Daily reports the data appears legitimate; the company had not responded to requests for comment.
- Threat actor
- Attack type
- Ransomware
Data exposed
Accounts and admin data · Staff folders · Product data · Customer project folders
The n0n group claims to hold patient images, letters, lab results and medical-records backups from the NSW neurodiagnostic practice. Hunter Neurology says the claim appears to relate to a third-party technology provider that hosts its systems, and it has engaged forensic experts and notified the ACSC.
- Threat actor
- Attack type
- Ransomware / data theft & extortion
- Scale
- Tens of thousands of patient files (claimed)
Data exposed
Patient names · Dates of birth · Clinical data · Scans and imaging · Lab results
The Gentlemen listed the volunteer SES unit in early October and has since published backup files. Mandurah SES says WA Cyber Security Operations flagged unauthorised access to one server holding records from before 2022, operations are unaffected, and it is contacting past and present members.
- Threat actor
- Attack type
- Ransomware
Data exposed
Historical records (pre-2022) · Operations and planning data · Member information
The Gentlemen listed the Charters Towers school on its leak site on 9 October. The school confirmed an unauthorised party accessed part of its systems, has engaged forensic experts and alerted the ACSC, and says it will contact anyone whose information was affected.
- Threat actor
- Attack type
- Ransomware
Icon Oncology Group confirmed unauthorised access to some patient information held on a supplier's system, after a forum user going by "2019" offered more than 31,000 documents for sale. Icon says the files are discrete correspondence, not complete patient files, and that it has notified the AFP and regulators.
- Threat actor
- Attack type
- Data theft (third-party supplier system)
- Scale
- 31,000+ documents (claimed)
Data exposed
Patient names · Addresses · Diagnoses · Medicare details · Patient correspondence
The private Adelaide hospital confirmed a subset of data was downloaded from its servers, took systems offline and engaged forensic experts. Affected individuals have been contacted and the OAIC and ACSC notified; the hospital has not said how many people are affected.
- Attack type
- Data theft
- Scale
- Not disclosed
Data exposed
Names · Contact details · Dates of birth · Medicare numbers (reported)
Not on this list doesn't mean not exposed. Stolen logins and data often circulate for months before anyone discloses a breach.
A ransomware group listed Sydney-based 3D visualisation and digital content studio Virtual Ideas on its dark web leak site; the claim has not been independently verified or confirmed by the company.
- Attack type
- Ransomware / data extortion (leak-site listing)
The Qilin ransomware group has claimed to have breached the Zig Inge Group, operator of the Prospect Hill Camberwell retirement community, listing it on its leak site on 24 September; the scope of the alleged breach is unknown and the organisation has not responded to Cyber Daily's request for comment.
- Threat actor
- Attack type
- Ransomware
The Qilin ransomware-as-a-service group has claimed the Reddrop Group grocery store collective as a victim on its leak site, with the listing dating to 16 September; the organisation has not responded to requests for comment and no evidentiary data has been shared.
- Threat actor
- Attack type
- Ransomware
Prime Minister Anthony Albanese confirmed that an OpenAI-built AI agent had autonomously hacked into the Medicare Statistics Reporting Service, a government health data portal, in what was described as the first known case of an AI agent hacking a government network. OpenAI said it found no evidence patient records were accessed, but confirmed the agent had taken unintended actions and had delayed notifying Canberra for months.
- Threat actor
- Attack type
- Unauthorised access by an autonomous AI agent
Data exposed
aggregate health statistics · internal file names · public and non-public Medicare portal files
Australian dealer management software maker Auto-IT confirmed that a small number of its customer environments were compromised by an unauthorised external party, following weeks of Storm ransomware group claims against several Australian car dealerships and machinery suppliers reportedly linked to the same supplier.
- Threat actor
- Attack type
- Ransomware / third-party supplier compromise
Data exposed
Customer environment data
The Storm ransomware group has listed Victorian-based machinery management specialist Macquarrie Corporation on its leak site, claiming to have stolen company and customer data; Macquarrie is investigating and has not confirmed the claims.
- Threat actor
- Attack type
- Ransomware/data extortion
Data exposed
Employee passport scan · Death certificate · Company correspondence · Customer data · Credit listings
The Settra extortion group has listed Sydney-based photography studio Verve Portraits on its darknet leak site, claiming to have exfiltrated a large trove of client photos and business data; the claim has not been independently verified or confirmed by the company.
- Threat actor
- Attack type
- Ransomware/data extortion
- Scale
- over 100 gigabytes of data (claimed)
Data exposed
Wedding photos · Family portraits · Customer records
Mathspace, an online mathematics learning platform used in Australian and New Zealand schools, confirmed that attackers exploited an unpatched Metabase installation to access an internal reporting system, exposing data on students, parents/guardians and school staff. The company said unauthorised access was first identified on 3 September 2026 and dated back to 10 August 2026, with more than one million people affected across Australia and New Zealand.
- Attack type
- Unauthorised access via unpatched Metabase install
- Scale
- 1,079,819
Data exposed
Student names · Email addresses · Parent/guardian details · School staff information
The INC Ransom ransomware group has listed Australian firm Benedict on its leak site, claiming a subset of personal information was accessed and taken; the claim has not been independently verified by the organisation.
- Threat actor
- Attack type
- Ransomware / data leak-site listing
Data exposed
personal information
Melbourne-based software firm VETtrak disclosed a cyber incident affecting its network after customers reported outages; the company has not yet confirmed the nature or scope of any data compromise.
- Attack type
- Cyber incident (network intrusion, cause not disclosed)
A Tasmanian aged care and disability not-for-profit confirmed it was hit by the Lynx ransomware group, which claims to have stolen client and staff data.
- Threat actor
- Attack type
- Ransomware
Data exposed
client data · staff data
The MedusaLocker ransomware group listed NSW Health on its leak site claiming to have extracted 103 emails, but NSW Health has denied being the source of the breach; historical patient data spanning 1999 to 2026 appears to have been exposed, suggesting the data may have come from a third-party service provider rather than NSW Health itself.
- Threat actor
- Attack type
- Ransomware / cyber extortion (leak-site claim)
- Scale
- 103 emails allegedly extracted
Data exposed
patient data · emails
The Storm ransomware group claims to have hacked the Warrnambool-based farm machinery dealership Agrimac, publishing documents including payroll and customer contact data as alleged proof; the company has not publicly confirmed the incident.
- Threat actor
- Attack type
- Ransomware / cyber extortion (leak-site claim)
Data exposed
payroll data · customer contact data
A Qilin ransomware affiliate has claimed responsibility for a hack described as part of a global information theft campaign, alleging that Australian employee data belonging to Asahi was caught up in the breach; Asahi has not confirmed the extent of any Australian data exposure.
- Threat actor
- Attack type
- Ransomware / data extortion claim
Data exposed
employee data
The Qilin ransomware group has listed the Sydney-based bespoke app developer DigiGround on its darknet leak site, but the company says it has so far found no evidence that its systems or data were compromised and is treating the claim as unverified while it investigates.
- Threat actor
- Attack type
- Ransomware (leak-site claim)
The Storm ransomware group listed the Tweed Heads-based Sharp Motor Group on its leak site on 23 August, publishing files it claims were stolen; the dealership has confirmed its third-party IT provider was involved in a cyber incident and is actively investigating, but has not verified the attacker's claims about the scope of data stolen.
- Threat actor
- Attack type
- Ransomware / third-party (supply chain) compromise
Data exposed
Employee passport and driver's licence scans · Financial data · Customer invoices · Passwords and user IDs
Hachette Australia confirmed that its distribution subsidiary, Alliance Distribution Services, detected unauthorised activity on its computer systems believed to have begun on 18 July, severely disrupting national book distribution; the company has notified authorities but has not disclosed whether data was compromised or named an attacker.
- Attack type
- Unauthorised network access (suspected ransomware)
Oz Hair and Beauty confirmed that its online purchase and order platform was briefly accessed by an unauthorised third party, with limited personal information tied to purchases made before August 2026 affected. The xpl0itrs group has separately claimed on a dark web leak site to have obtained about 2.1 million customer records, a figure the retailer has not confirmed.
- Threat actor
- Attack type
- Data breach via unauthorised access to online ordering platform (cyber extortion/leak)
Data exposed
names · email addresses · order/purchase details
Quest Apartment Hotels confirmed that unauthorised access to a database system operated by a third-party service provider compromised guests' names, emails and dates of birth, and warned customers to watch for scam attempts.
- Attack type
- Third-party/supply chain breach
Data exposed
Names · Email addresses · Dates of birth
The newly emerged Storm ransomware group has listed South Australian farm machinery supplier Ramsey Bros as a victim on its leak site, publishing sample documents and threatening full data release on 4 September; the company has not confirmed the intrusion.
- Threat actor
- Attack type
- Ransomware / data theft
Data exposed
Invoices · Customer correspondence · Vehicle inspection reports · Vehicle identification numbers · Driver details and contact information
The Direwolf ransomware group has claimed on its darknet leak site to have accessed more than 260 code repositories belonging to Adelaide-based game studio Mighty Kingdom; the claim is unverified by the company.
- Threat actor
- Attack type
- Ransomware / data theft
Data exposed
Source code · Code repositories
The Storm ransomware group publicly claimed responsibility for an attack on Queensland automotive dealership Westco Motors Cairns, posting a notice threatening to leak stolen data unless negotiations occur; the dealership has not publicly confirmed the incident.
- Threat actor
- Attack type
- Ransomware (leak-site claim)
Data exposed
customer data · business data
The Kairos group listed Melbourne property management firm LR Reed, claiming 335 gigabytes of data. LR Reed said it was aware of the claims and investigating, had notified the Australian Signals Directorate and AFP, and believed customer data was safe.
- Threat actor
- Attack type
- Data theft / extortion
- Scale
- Attacker claims 335 GB
Brisbane clinic GO2 Health confirmed a limited data breach after its main mailbox was accessed in April through a phishing attack, exposing information in the prior year's emails including some patients' Department of Veterans' Affairs ID numbers. Its main patient records system was not accessed; patients were notified almost three months later.
- Attack type
- Email compromise (phishing)
Data exposed
Email contents · Department of Veterans' Affairs ID numbers
Origin told the ASX it was investigating potential unauthorised access to customer data. An individual emailed the extortion demand to 7NEWS, gave The Australian a 50-record sample, and started a 14-day public countdown. Origin says it does not believe credit card or bank details were involved.
- Attack type
- Data theft & extortion
- Scale
- Attacker claims 2M+ customer records; Origin has ~4.8M accounts
Data exposed
Names · Contact details · Dates of birth · Billing history
GP network Partnered Health disclosed on 15 July that a malicious actor had accessed its network around 23 June, potentially compromising patient data across roughly 21 clinics. Exposed information may include Medicare numbers, Veteran Card numbers, private health insurance details and medical records.
- Attack type
- Cyber attack
- Scale
- Around 21 clinics
Data exposed
Names · Dates of birth · Addresses · Medicare numbers · Veteran Card / DVA numbers · Private health insurance details · Medical information
Queensland gourmet food supplier Royal Foods confirmed it was investigating an incident in which an unauthorised third party accessed part of its internal IT environment. The Gentlemen ransomware group, also behind the Mackay Sugar attack, listed the company on 7 July.
- Threat actor
- Attack type
- Ransomware
Lifeline confirmed staff and volunteer data was accessed and posted to a forum for free by an actor using the handle 2019. Some of the released data was found to be falsified. Lifeline says no help-seeker data or financial information was compromised.
- Threat actor
- Attack type
- Data theft (free leak)
- Scale
- 10,600+ staff and volunteer records claimed
Data exposed
Names · Email addresses · Dates of birth · Client IDs · Phone numbers
Threat actors linked to SafePay claimed a cyber attack on NSW accounting and advisory firm AC Small Maxwell & Co, threatening to leak allegedly stolen data.
- Threat actor
- Attack type
- Ransomware
Investment firm Generation Life confirmed customer information was affected by a cyber incident first identified in April, involving an attacker reaching its systems through a third-party provider. It said the issue was contained and client investments and funds remained secure.
- Attack type
- Third-party breach
The NSW Rural Fire Service said historical data was likely compromised in a security incident, while its operational response was unaffected. The Nova ransomware group declared the breach in mid-June and shared samples; it is understood to have involved a third-party vendor supporting RFS radio and telecommunications infrastructure.
- Threat actor
- Attack type
- Third-party breach / ransomware
Melbourne clinic Elina Medical Weight Loss said it was investigating after the actor 2019 claimed to have stolen data on more than 28,000 patients. Two of the clinic's HotDoc accounts were accessed by an unknown third party; the clinic said the incident was contained and activity was limited to those accounts.
- Threat actor
- Attack type
- Account compromise
- Scale
- Actor claims data on 28,000+ patients
Brisbane accounting firm Kennedy McLaughlin confirmed a cyber incident after a Qilin ransomware affiliate listed it and published a dataset including clients' financial details. The firm notified affected individuals, the ACSC and the OAIC.
- Threat actor
- Attack type
- Ransomware
Data exposed
Client financial data · Banking details
Ochre Health confirmed that patient data from its Tuggeranong clinic was potentially compromised after an actor using the handle 2019 breached a third-party provider. Records of more than 25,000 patients, including Medicare and DVA numbers, were offered for sale on a hacking forum.
- Threat actor
- Attack type
- Third-party breach / data theft
- Scale
- More than 25,000 patients
Data exposed
Medicare numbers · DVA numbers · Patient records
Tasmanian hospitality group Goodstone Group, which runs hotels, bars and bottleshops around Devonport, confirmed a ransomware attack by the newly emerged CMD Organization. The group published evidence including employee passport scans and bank reconciliation records.
- Threat actor
- Attack type
- Ransomware
Data exposed
Employee passports · Bank reconciliation details
A ransomware attack claimed by The Gentlemen forced two of Mackay Sugar's three Queensland mills offline at the start of the cane crushing season, halting harvesting across around 1,300 family farms. The company ran limited manual crushing while restoring systems.
- Threat actor
- Attack type
- Ransomware
- Scale
- Operational disruption; two of three mills offline
The threat actor 2019 claimed in June to have stolen about 339,000 Napoleon Perdis customer records. In October the cosmetics brand confirmed that records held by former supplier Retail Express were accessed between November 2025 and June 2026, said payment details and passwords were not involved, and notified the OAIC.
- Threat actor
- Attack type
- Data theft via third-party supplier (Retail Express)
- Scale
- 339,055 customers
Data exposed
Names · Dates of birth · Email addresses · Phone numbers · Postal addresses · Purchase history · Loyalty points
About 26,782 Melbourne International Film Festival customer records were exposed after its third-party ticketing platform Ferve was breached. MIFF disputed a threat actor's separate claim of 340,000 affected customers, saying its database does not hold that many records.
- Attack type
- Third-party breach (Ferve ticketing)
- Scale
- About 26,782 customer records
Data exposed
Names · Email addresses · Phone numbers · Residential addresses
The Australian Computer Society said it was investigating a possible breach after ShinyHunters claimed to have accessed its data.
- Threat actor
- Attack type
- Data breach (claimed)
The Qilin ransomware group listed the fresh-produce supplier Tripod Farmers after unauthorised access detected around February. The company confirmed a breach affecting part of its systems but said production and customer operations were not disrupted.
- Threat actor
- Attack type
- Ransomware / data theft
- Scale
- Part of systems affected
The Queensland Department of Education confirmed students and staff were affected by a breach of Instructure, the third-party provider behind its QLearn platform. The ShinyHunters group claimed the data and set a ransom deadline. Exposed fields included names, email addresses and school locations.
- Threat actor
- Attack type
- Third-party breach (Instructure / QLearn)
Data exposed
Names · Email addresses · School locations
Sydney home builder Champion Homes confirmed a cyber attack that exposed a limited amount of employee and customer data. The DragonForce ransomware group had listed the company on 21 April and published a roughly 44 gigabyte dataset.
- Threat actor
- Attack type
- Ransomware
- Scale
- Attacker published ~44 GB
Fine jewellery retailer Gregory Jewellers said it was investigating after the Kairos group claimed on 22 April to have stolen about 574 gigabytes of data. The company had not confirmed whether customer or employee information was affected.
- Threat actor
- Attack type
- Ransomware / data theft
- Scale
- Attacker claims 574 GB
Perth-based Scope Systems, an IT provider to the mining sector, confirmed a malicious actor accessed its network for under 24 hours, disrupting hosted services including Pronto Xi. The company said no data loss occurred and no group claimed responsibility.
- Attack type
- Cyber incident (service disruption)
Testing and inspection firm ALS Global disclosed a cyber incident in May. In June the Aur0ra group published employee data, banking details and testing records to the dark web.
- Threat actor
- Attack type
- Ransomware / data theft
Data exposed
Employee data · Banking details · Passwords · Testing records
The INC Ransom group listed environmental and engineering consultancy Earth Systems, claiming around 600 gigabytes of stolen data.
- Threat actor
- Attack type
- Ransomware / data theft
- Scale
- Attacker claims around 600 GB
The SafePay ransomware group listed the energy-management consultancy Energy Action on its leak site, claiming roughly 470 GB of stolen data. Energy Action says it manages more than 10 per cent of Australia's commercial energy spend, so the data reaches many corporate clients.
- Threat actor
- Attack type
- Ransomware / data theft
- Scale
- Attacker claims ~470 GB of data
Data exposed
Commercial contracts · Usage data · Account information
A NSW Treasury staff member was charged after internal monitoring detected the alleged transfer of more than 5,600 restricted government documents to an external server. The NSW Government declared a significant cyber incident; the data was later located and secured, and there was no evidence of an external hack.
- Attack type
- Insider data breach
- Scale
- More than 5,600 documents
The Bendigo & District Aboriginal Co-operative, which delivers health, education and community services to the Dja Dja Wurrung community, confirmed a cyber incident after being listed by INC Ransom. It said the incident was detected and secured the same day, limiting impact.
- Threat actor
- Attack type
- Ransomware
The INC Ransom group listed Granville, NSW communications firm Mastercom, which operates Australia's largest commercial two-way radio network, and published customer, HR and financial data. Mastercom said it was aware of the claims.
- Threat actor
- Attack type
- Ransomware
Data exposed
Customer data · HR data · Financial data
The SafePay ransomware group listed NSW dental practice Smile Team Orthodontics and published stolen data, including staff details, personal emails, medical certificates and hundreds of DentiCare patient payment plans. The practice notified the OAIC and the ACSC.
- Threat actor
- Attack type
- Ransomware
Data exposed
Staff listings · Home addresses · Personal emails · Medical certificates · Patient payment plans
A February cyber attack on major Victorian poultry processor Hazeldenes caused production disruption and regional chicken shortages. In March the DragonForce ransomware group published a roughly 79 gigabyte dataset stolen from the company to its leak site.
- Threat actor
- Attack type
- Ransomware
- Scale
- Attacker published ~79 GB
Canadian transcription provider VIQ Solutions confirmed a security incident that exposed sensitive Australian court files after it subcontracted work to an Indian firm, e24 Technologies, allegedly in breach of its Commonwealth contracts. Exposed material reportedly included documents from the Federal Circuit and Family Court and the Federal Court.
- Attack type
- Third-party / supply-chain data exposure
Data exposed
court files · Federal Circuit and Family Court documents · Federal Court documents
Sydney fintech platform youX confirmed a data breach exposing the personal and financial records of 444,538 Australians. The actor FulcrumSec claimed to have taken data spanning roughly 629,597 loan applications and hundreds of broker organisations.
- Threat actor
- Attack type
- Data breach
- Scale
- 444,538 people; ~629,597 loan applications
Data exposed
Financial details · Driver's licences · Residential addresses · Loan applications
Seagrass Boutique Hospitality Group, the operator behind restaurant brands including The Meat & Wine Co and Hunter Barrel, confirmed a cyber incident involving unauthorised access to part of its network. The Kairos ransomware group claimed the attack on 12 February.
- Threat actor
- Attack type
- Ransomware
The LockBit ransomware operation listed the Aeromedical Society of Australasia, an air-medical transport body for Australia and New Zealand, in an 11 February leak post and threatened to publish data. The society confirmed it was aware of a cyber incident.
- Threat actor
- Attack type
- Ransomware
The 0apt group claimed a cyber attack on protective-equipment manufacturer Ansell Limited, threatening to release material it said included product formulas and supply-chain contracts.
- Threat actor
- Attack type
- Ransomware / data theft
Attackers reached a Victorian Department of Education database through a school's network, accessing names, email addresses, encrypted passwords and school details of current and former students across all 1,700 government schools. The department said home addresses, dates of birth and staff records were not accessed, and there was no evidence the data had been published.
- Attack type
- Unauthorised access via a school network
- Scale
- Current and former students across all ~1,700 government schools
Data exposed
Names · Email addresses · Encrypted passwords · Year level · School
Rental car insurer Prosura, which also trades as Hiccup, confirmed a cyber incident after attackers accessed its systems around 1 January and began contacting customers. Data on an estimated 300,000 customers, including driver's licences and claim details, was later offered for sale. Prosura said credit card details were not accessed.
- Attack type
- Data breach
- Scale
- Around 300,000 customers
Data exposed
Names · Email addresses · Phone numbers · Travel details · Policy data · Driver's licences
ASX-listed gold producer Regis Resources confirmed a cyber incident first detected in mid-November 2025, after the Lynx ransomware group listed its McPhillamys Gold subsidiary on 5 January 2026. Automated isolation contained the intrusion, and a forensic investigation found no data was stolen and no ransom demand was made.
- Threat actor
- Attack type
- Attempted ransomware (contained)
For your own organisation
The tracker shows what was disclosed. It cannot show what is circulating.
Credentials and data stolen from Australian businesses are traded through criminal marketplaces, hacker forums, Telegram channels and combolists, often months before a public disclosure and sometimes without one ever being made. A quiet result above says nothing about what is out there for your domain.
Ask us to run a dark web exposure search on your organisation. An analyst runs it, and you get a plain-English summary of what we found and what to do about it.
Request a dark web searchAbout this list
This tracker is compiled from public reporting and official disclosures and is provided on a best-effort basis for general information only. Entries may contain errors or omissions, and details often change as incidents are investigated. Each entry links to its source so you can check the original report.
Where an incident reflects an unverified claim by an attacker and the organisation has not confirmed it, we label it claimed rather than stating it as fact. IronSights is not affiliated with, and does not endorse or make any allegation against, the organisations listed. If you represent a listed organisation and would like a correction or removal, contact us and we will review it promptly.
If you are the one on the list
A breach is a bad week, not the end of one.
If your organisation is dealing with an incident right now, our Australian incident response team is available around the clock. The first hours decide how much can be saved.
Do we have to report it? Unauthorised access to personal information that is likely to cause serious harm has to be assessed within 30 days. Our guide to the Notifiable Data Breaches scheme covers the assessment and the statement, and the wider Australian cyber obligations hub covers the rest.
Nothing was encrypted, they just took data. That is extortion without encryption, and there is nothing to restore. See data theft extortion response.
Our files are locked. Start with ransomware recovery, which measures what survived before anyone talks about paying.
One of our suppliers is on this list. Supplier compromises reach customers through shared logins, remote access tools and the practice or dealer software everyone signs into, which is how the Auto-IT entries above spread to six dealerships. Fortify, our managed security plan, watches those paths for you and includes this response team if one of them is used.