On 29 August 2023, Defence Housing Australia (DHA) was made aware of a cyber security breach affecting a third-party service provider. An initial notification regarding this breach was published on the DHA website on 6 September 2023.

The third party provided call centre services to DHA from 2010. The service provider is no longer providing these services.

DHA is providing an update as its investigation has now closed based on the information provided to DHA by the service provider.

Details of the breach

DHA understands the breach involved unauthorised access to the service provider’s IT environment and the theft of data held by the service provider, including information related to DHA. There was no access to, or breach of DHA’s systems.

DHA provided notification of the breach to Defence, the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC) and the Department of Home Affairs’ Cyber Security Response Coordination Unit (CSRCU).

Impact of breach

The information held by the service provider was historical (dating back to 2015) contact information of Defence personnel residing in DHA housing. DHA believes that the contact information also included the business name and Australian Business Numbers (ABN) of some of DHA’s maintenance contractors. DHA maintains a level of certainty that the exposed data was minimal and mostly contained historical and outdated information insufficient to enable identity theft.

Advice to members

Anyone concerned about their information or seeking further guidance on steps they can take to protect themselves may contact DHA on 139 342.

More information on online safety, cyber security and helpful tips to protect yourself against online risks can be found at the following government websites:

• ASD: cyber.gov.au
• OAIC: oaic.gov.au/privacy/your-privacy-rights/ways-to-protect-your-privacy
• National Scam Watch Centre: scamwatch.gov.au