Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
A former NSW government contractor is under fire for breaching the privacy of thousands of flood victims after it posted their data to ChatGPT.
The NSW Reconstruction Authority (RA), the state agency responsible for mitigating damage from natural disasters, announced that it was aware that a “data breach” had occurred, impacting thousands of those who applied to the Northern Rivers Resilient Homes Program (RHP), which provides financial assistance to those looking to improve the flood resistance of their homes.
“The breach occurred when a former contractor of the RA uploaded data containing personal information to an unsecured AI tool which was not authorised by the department,” the NSW government said.
“There is no evidence that any information has been made public; however, Cyber Security NSW will continue to monitor the internet and the dark web to see if any of the information is accessible online.”
According to a NSW government release, the former contractor posted 10 columns and over 12,000 rows of data from a Microsoft Excel spreadsheet into ChatGPT.
Based on “early forensic analysis”, as many as 3,000 people may have been impacted, with data exposed to ChatGPT including names, addresses, email addresses, phone numbers, and personal and health data.
However, the NSW government said it is working with Cyber Security NSW to investigate what data was shared with the AI chatbot.
“Every row is being carefully reviewed to understand what information may have been compromised,” the NSW government said.
“This process has been complex and time-consuming, and we acknowledge that it has taken time to notify people. Our focus has been on ensuring we had the right information to contact every impacted person accurately and completely.”
The government has also notified the NSW Privacy Commissioner, internal processes and systems have been bolstered, and guidance on the use of AI platforms has been issued to staff.
Additionally, Cyber Security NSW and the RA are monitoring the dark web for any instances of data being published.
“Safeguards are now in place to prevent similar incidents in future,” the NSW government said.
Those impacted will be notified of the incident within a week to confirm what data was shared.
Be the first to hear the latest developments in the cyber industry.
