Personal Information of Service NSW Customers Exposed in Privacy Incident
Service NSW, a government agency that provides services to New South Wales residents, has reported a privacy incident that exposed the personal information of its customers. An update to the “My Services” dashboard on March 20, 2023, caused the breach. According to the agency, affected customers were logged in to their MyServiceNSW account between 1:20 PM and 2:54 PM. The breach exposed personal information available through linked services, including driver’s licence and vehicle registration details, contact information, and children’s names.
Not a Cyberattack, but a Serious Breach
Although the incident was not a cyberattack, it is a serious breach that affects the privacy of thousands of Service NSW customers. The agency believes that any risk of harm presented by this incident is very low. However, some affected customers have expressed concerns that the personal information exposed in the breach is significant, and the messaging from the agency does not inspire confidence.
Investigation and Notification
Service NSW is investigating the incident, and the Information and Privacy Commission and affected customers have been notified. The dashboard page was taken down at 3 PM, and the issue was resolved quickly. About 3700 customers may have been impacted during the time of the incident.
State Government Agencies to Improve Cybersecurity
The NSW government invested $315 million to bolster cyber systems and introduced the Privacy and Personal Information Protection Amendment Bill in November last year. The changes, which include a mandatory notification scheme for state government agencies, will come into effect from November 28, 2023.
What Should Service NSW Customers Do?
Customers who have a MyServiceNSW account are advised to change their password, monitor their accounts for any suspicious activity, and enable two-factor authentication. It is also essential to use unique passwords for each online account and be wary of any unsolicited messages or calls claiming to be from Service NSW or other organisations that may attempt to scam using the exposed information.
