Service NSW, the New South Wales government’s one-stop shop for service delivery, has issued a warning to customers that their personal data may be caught up in a data breach. Well, the wording the agency has used was “exposed” but that’s just a polite way of saying “breached” – sharing your info without your consent to another party is a data breach, even if it is just for 90 minutes.
In an email sighted by Gizmodo Australia, Service NSW detailed the type of information that was potentially ‘exposed’ to another NSW resident. This included driver’s licence details (name, address, date of birth, as well as demerit points balance, licence conditions, email address, mobile number), vehicle registration (name, CTP insurance info) and kid’s name/s. Yikes.
Here’s a copy of the breach notice sent by Service NSW a kind citizen posted on Twitter.
Full email: pic.twitter.com/XdjBh1iw6V
— Richard Nelson (@wabzqem) April 3, 2023
As you can see from the embedded tweet above, Service NSW said that on March 20, it released an update to the My Services dashboard which “unfortunately” resulted in some residents seeing other residents’ information. It was only a brief time the breach happened for, about 1.5 hours, but it was still a massive boo-boo nonetheless.
A Service NSW spokesperson confirmed with Gizmodo Australia that the breach affected about 3,700 customers. But it’s calling it a “recent technical issue”.
“Between 1.20pm and 3pm on Monday 20 March 2023, some Service NSW customers experienced technical issues when logged into their MyServiceNSW account via a web browser,” the spokesperson explained.
“The problem was limited to the landing dashboard when customers logged in via the website, no issues were identified with the Service NSW mobile application.”
The dashboard page was taken down at 3 pm and the issue was resolved quickly, they added.
Service NSW said the breach wasn’t the result of a cyber-attack, but that it notified the Information and Privacy Commission the day of the incident nonetheless.
“Our priority is the safety and security of every customer affected by the incident, and we are committed to ensuring customers feel supported,” the spokesperson added.
Impacted customers can contact ID Support NSW by phone on 1800 001 040 or via the online form.
[related_content first=”1819416″]
In April 2020, Service NSW experienced a cyber attack that compromised the information of 186,000 customers. Following a four-month investigation, Service NSW said it identified that 738GB of data, which comprised of 3.8 million documents, was stolen from 47 staff email accounts.