At a glance
- Company
- NSW Reconstruction AuthorityState government agency for disaster recovery
- Where and when
- Australia (New South Wales). March 2025 – March 2026.
- Who produced the figures
- Official recordEverything on this page comes from the agency’s own public notice about the breach, last updated on 26 March 2026.
What happened
The agency runs a programme that helps people whose homes were hit by floods. Between 12 and 15 March 2025, a temporary staff member uploaded a spreadsheet of applicants to ChatGPT. The agency had not approved the tool. The staff member no longer works there.
The agency says its own systems were not hacked and stayed secure. The data left because a person put it into an outside tool.
The numbers
- 2,031 people had some of their personal information uploaded.
- One Excel file, with 10 columns and more than 12,000 rows.
- What it held: names and contact details, addresses, dates of birth and sensitive health information. It also held some comments about finances. It did not hold bank details or identity-document numbers.
- No sign of publication. The agency says there is no evidence that the data is publicly available online. The state’s cyber security service keeps checking.
What the agency changed
- It commissioned an independent review, which found things to improve in governance, training and data security.
- It wrote a data-breach policy and updated its privacy plan to include guidance on AI.
- It strengthened compulsory staff training on handling data.
- It limited manual downloads of data from its core systems.
- It put in controls that block uploads of personal information to AI tools.
- It is setting up a dedicated privacy function.
What the case shows
- One upload was enough. A single file, moved by a single person, reached more than 2,000 people’s records.
- Temporary staff need the rules too. The person who uploaded the file was a temporary worker.
- The fix was a mix. The agency did not rely on a written rule alone. It added training, limited what can be downloaded, and blocked uploads.
What this says about the practices
What the company changed afterwards
- Decide what data may go into which AI tools After the breach the agency put in controls that block uploads of personal information to AI tools, and limited manual downloads from its core systems. Do first · Effort: low (days, one person)
- Write a one-page AI-use policy staff will actually read The agency updated its privacy plan to include guidance on AI, and brought in a data-breach policy of its own. Do first · Effort: low (days, one person)
- Train staff on the tools you actually chose A review found gaps in governance, training and data security. The agency then strengthened its compulsory staff training on handling data. Do first · Effort: medium (weeks, a few people)
Sources
- NSW Reconstruction Authority. Resilient Homes Program data breach. Public notice and questions and answers (updated 26 March 2026). nsw.gov.au