This is a work in progress. While we strive for accuracy, some breach details may be incomplete or pending verification.

NSW Department of Communities and Justice

Summary

The NSW Department of Communities and Justice suffered a significant data breach on 25 March 2025 when an account holder used a malicious Python script to gain unauthorised access to the NSW Online Registry Website system. Approximately 9,000 sensitive court documents were downloaded, including apprehended violence orders, affidavits, and potentially information about minors.

What Happened

On 25 March 2025, investigators discovered that an account holder within the JusticeLink system had gained unlawful entry using a malicious Python script. The attacker infiltrated a unit within the JusticeLink system and downloaded approximately 9,000 sensitive court files from the NSW Online Registry Website, which provides access to information about both civil and criminal cases across the NSW court system. The breach was publicly announced on 27 March 2025 by NSW Attorney-General Michael Daley. The Department of Communities and Justice patched the system at 8pm on Tuesday, and the compromised account and its malicious activities were halted.

Impact on Individuals

The breach exposed highly sensitive legal information from approximately 9,000 court files, potentially including apprehended violence orders, affidavits, and details relating to minors. The documents accessed through the NSW Online Registry Website contained personal information from both civil and criminal court proceedings.

Organisational Response

The Department of Communities and Justice immediately commenced containment measures, patching the compromised system and terminating the malicious account's activities. NSW Police established Strike Force Pardey to investigate the breach, working closely with the Department to determine the full extent of the incident and identify which specific data was accessed.

NSW Police Cybercrime detectives launched a criminal investigation under Strike Force Pardey to investigate the unauthorised system access and data theft.

Verification Source: View original statement