Human Rights Group’s Complaint Forms Exposed on Internet

The Australian Human Rights Commission said unprotected online complaint forms exposed the personal, healthcare and demographic information of Australians to the public internet for over a month.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The human rights group said it learned about the accidental disclosure of citizens’ complaints on April 10 and determined that the exposed records contained sensitive personal information of people who filed complaints between March 24 and April 10.

The commission said the disclosure also exposed online attachments uploaded through its web forms for its Speaking from Experience Project, Human Rights Awards 2023 nominations and the National Anti-Racism Framework concept paper.

“Around 670 documents were made potentially accessible in error. Of these, around 100 documents were accessed online, for example by search engines such as Google or Bing,” the commission said. “Many of these documents contain personal information. Some documents contain no personal information and others contain information that is already publicly available.”

The exposed forms contained Australians’ personal and demographic information, including names, email addresses, street addresses, mobile numbers, employers and roles, work contact information, personal health information, educational background, religion and photographs. AHRC said the public disclosure of the forms occurred between April 3 and April 10.

The commission reported the cybersecurity incident to the Office of the Australian Information Commissioner and said it formed a task force to respond to the incident, identify the number of people affected and remove sensitive information from search engines.

The commission has disabled all web forms on its website as a precaution, but citizens can still file complaints or nominations by downloading PDF or Word versions of forms from the website and submitting the completed forms by email or mail.

The group’s breach notification coincided with the release of the Office of the Australian Information Commissioner’s Notifiable Data Breaches report, which found that government agencies accounted for 100 out of 595 breach notifications between July and December.

“Individuals often don’t have a choice but to provide their personal information to access government services. This makes it even more important that agencies keep personal information secure and have an action plan in place should a breach occur,” Information Commissioner Carly Kind said.

Human error accounted for 29% of all reported breaches, and most of those breaches resulted from personal information being shared with the wrong recipients or disclosed online.

Kind said government agencies lag behind other sectors in terms of timely detection and notification of cybersecurity incidents. The Australian Human Rights Commission data leak began on March 24 but the group failed to detect the exposure until April 10 and notified the public over a month later.

The Australian Information Commissioner said government agencies reported 63 cyber incidents in the first half of 2024, but took more than 30 days to identify 87% of those incidents.