The Australian Sports Commission has been investigating the unauthorised access of an agency email account since 7 November 2019 when a staff member reported unusual activity on their account.
The investigation found no evidence any other ASC email accounts or systems have been compromised.
With close support from the Australian Cyber Security Centre and Microsoft, the ASC has undertaken a thorough review into the incident. At this stage of the investigation we have determined that it is not possible to conclusively determine if any personal information contained in the email account was extracted by an unauthorised person.
As a precaution and to ensure the continued safety of people’s information, we are making it a priority to inform and support every individual who may have been impacted.
We have established that the email account contained references to approximately 18,900 individuals. The vast majority of these individuals are referenced by either their name and/or birthdate, or other basic contact information.
There are a small number of people that we consider to have had more sensitive personal information contained within the account, such as medicare card or driver licence details, passport information and health information. We are contacting each of these people directly to inform them and provide additional support.
We take our responsibility for protecting private and trusted information very seriously and have invested heavily in keeping our IT security systems strong and secure.
To protect the ongoing security of personal information referenced in the email account, we have engaged with IDCARE, a national identity and cyber support service, to provide daily online monitoring to detect any inappropriate use.
The ASC has set up a support line, which can be accessed by calling 1800 318 237.
We have engaged IDCARE, a national identity and cyber support service. Their Case Managers work with tens of thousands of Australians each year who confront personal information and privacy risks. You can contact IDCARE via their online support request form, opens in a new tab and by quoting the referral code ASP 19 H.
The incident has been reported to the Office of the Australian Information Commissioner and referred to the Australian Federal Police. The Police Report Number for this incident is PN 6416080.