NSW Courts online hack under police investigation

New South Wales cybercrime detectives have commenced an investigation into a data breach of the NSW Online Registry Website (ORW) involving thousands of “sensitive court files”.

According to NSW Police, its State Crime Command’s Cybercrime Squad was told on 25 March that “approximately 9000 sensitive court files, including apprehended violence orders and affidavits, were downloaded from the ORW”.

The online platform provides access to information involved in both civil and criminal cases across the State’s court system and is part of the NSW Department of Communities and Justice (DCJ).

Cybercrime detectives have commenced an investigation under Strike Force Pardey and are working closely with DCJ to contain the breach.

According to the NSW Data Breach Policy for high-risk data breaches, the Breach Response Team will consider external help from organisations such as law enforcement agencies, NSW Police Force and/or Australian Federal Police, among others.

Data breaches in NSW will come under the Mandatory Notification of Data Breach (MNDB) Scheme, which states that agencies must notify the Privacy Commissioner.

Affected individuals will be notified in the event of an eligible data breach of their personal or health information by a public sector agency or state-owned corporation subject to the Privacy and Personal Information Protection Act 1998 (PPIP Act).

Sydney-based, Marque Lawyers managing partner Michael Bradley told ARN “it would be difficult to overstate” the damage of a “data breach” of this kind.

“Court files contain massive volumes of incredibly sensitive information, the disclosure of which could cause devastating harm including placing people’s safety at risk,” he said.

“For example, the compromised data could include personal information that has been the subject of court-imposed suppression orders or statutory suppression which protect the identities of victims of crime or witnesses.

“It could include commercially confidential information, national security information.

“The courts are privy to a vast array of material that should ordinarily never see the light of day. A breach may undermine the confidence of the legal profession and the public in the justice system as a safe place for sensitive information to be disclosed. It should be impossible.”