NSW Department of Education Vendor Cyber Rating & Cyber Score

Description: NSW Police Leak Exposes Email Addresses of 150 Complaintants in Data Breach The NSW Police have inadvertently disclosed the email addresses of over 150 individuals who filed complaints regarding officers’ use of force during the Sydney Black Lives Matter protest on 6 June. The breach occurred when a police response to a complainant Samuel Leighton-Dore, who raised concerns after viewing footage of officers deploying pepper spray into a kettled crowd was sent with an attached list of all recipients’ emails. Leighton-Dore, who was advised by the Law Enforcement Conduct Commission (LECC) to direct his complaint to NSW Police, received a one-page response from Craig Lowery, Professional Standards Manager, stating that no further investigation was warranted after reviewing body-worn camera footage. Dissatisfied with the decision, Leighton-Dore later received a second email containing the original letter along with a page listing the email addresses of 150 other complainants. The incident appears to violate Section 169A of the Police Act 1990 (NSW), which prohibits the disclosure of complainants’ identities without proper authorization. A NSW Police spokesperson acknowledged the error as an "administrative mistake" but provided no further details on how it occurred or whether affected individuals would be notified. The breach has intensified criticism of NSW Police’s internal handling of complaints, with one commentator calling it a "complete betrayal of public trust and accountability." Leighton-Dore reported that police initially claimed he was the sole complainant, contradicting the lengthy list of exposed emails. The LECC, tasked with overseeing police misconduct investigations, faces chronic underfunding, allowing NSW Police to self-investigate most complaints a process advocates argue is inherently biased. The commission reportedly investigates only 2% of reported cases, raising concerns about systemic oversight failures.

Description: The NSW government's QR code data breach accidently exposed the regional addresses of more than 500,000 organisations including defence sites, a missile maintenance unit and domestic violence shelters The addresses collected by the NSW government including correctional facilities, critical infrastructure networks including power stations and tunnel entry sites as well as dozens of shelters and crisis accommodation centres for women across the state was also found NSW data website. The cyber experts raised the alarm to the NSW government to secure the data immediately.

Description: The New South Wales (NSW) education department in Australia stated that their internal system had been a victim of a cyber attack. The department took some systems offline while conducting its investigation because protecting student and staff data is of the utmost importance. The department has reported the issue to the state's police and federal government organizations and collaborated with Cyber Security NSW to find a solution.

Description: In February 2021, Transport for NSW, an Australian government agency responsible for managing the state’s transport systems, fell victim to a Clop ransomware attack. The breach was part of a broader global campaign exploiting vulnerabilities in Accellion’s File Transfer Appliance (FTA), a third-party file-sharing service used by the agency. While the full extent of the data compromise was not publicly disclosed, the attack exposed sensitive internal documents, including employee records, financial data, and potentially customer-related information. The Clop ransomware group, known for double-extortion tactics, threatened to leak stolen data unless a ransom was paid. Although Transport for NSW refused to negotiate, the incident disrupted operations, raised concerns over data security, and prompted an urgent review of cybersecurity protocols. The breach highlighted vulnerabilities in third-party vendor systems and underscored the growing threat of ransomware targeting critical public infrastructure. Authorities warned that the stolen data could be used for further phishing attacks or sold on the dark web, posing long-term risks to both the organization and affected individuals.