How to respond to a data breach: individuals

This page contains guidance for individuals who have had their information involved in a data breach.  Follow the advice provided by the organisation and read the guidance below.

Data breaches

Data breaches occur when personal or sensitive data is:

• accessed
• disclosed or
• exposed to unauthorised people.

Cybercriminals can use stolen personal data to commit cybercrimes including compromising personal online accounts or identity theft and fraud.

Find out how you can minimise the impact of a data breach on the Australian Government’s Australian Signals Directorate (ASD) website.

Have I Been Pwned is a free service where you can check if your email has been compromised in a previous data breach.

Know how you have been affected

The organisation affected by a cyber incident may contact you or you may hear about it through media reports.

In nationally significant cybersecurity incidents, the Australian Government’s National Cyber Security Coordinator may issue public statements to the media and on social media.

The ASD's Have you been hacked? Tool will tell you the steps to take to secure your finances, accounts, email and identity. Select ‘My information has been lost or stolen’

Be aware of phishing and scams

When your personal information is stolen through a cyberattack you can be targeted in cyber scams, such as:

• phishing
• identity theft
• online account compromise
• extortion.

Cybercriminals or scammers impersonate organisations in communications such as email, text, or phone and may pose as a trusted organisation to offer assistance following a data breach.

Scammers may send you an email telling you to reset your password.

Don’t use links or contact details in the message.

Always visit the official website or app to log in to your account and use published contact details.

Read more on the ASD website about phishing and impersonation scams.

If you have clicked a link or feel you have been scammed - refer to ASD's So you think you've been been hacked tool.

Always immediately contact your bank to report the scam and ask them stop transactions.

Also report to ScamWatch.

Secure your accounts

If your password has been compromised in a data breach, reset all accounts that use that same password as soon as possible.

Use a unique password for each online account and use a passphrase to make your passwords longer and stronger – at least 15 characters and not easily guessable.

To change your password or passphrase login to your account's online platform or app directly.

Use unique passphrases on your:

• bank
• email
• social media accounts
• online services that contain personal or financial data.

Read ASD’s guides on creating passphrases and using password managers.

Review your security settings across other accounts.

Some online services allow you to view what devices have recently used your login details and any recent transactions.

Multi-factor authentication (MFA)

Also implement MFA on these services. MFA adds extra verification steps to access your accounts.

Read ASD's guide to turn on multifactor authentication.

Email security

If someone gains unauthorised access to your email account, they can intercept or gain access to your private communications.  Find out how to identify if your email account has compromised and how to secure your email.

Read ASD’s guide on email security.

Review your security settings across other accounts. Some online services allow you to view what devices have recently used your login details and any recent transactions.

Secure your identity

If your sensitive personal data was included in a data breach you may be at risk of identity theft.

Depending on the data breached, you may need to replace government-issued documents.

The organisation that has been breached may contact you directly or publish advice to assist you to identify what data has been compromised.

If your driver licence details were included in a data breach you may not need a replacement.

Read below for support services to help you.

IDCARE are here to help

IDCARE is the Australia and New Zealand’s national identity support service.

If you need support, you can:

• complete the get help form or
• call 1800 595 160.

They have an identity and cyber security case managers ready to work with you to:

• develop a specific response plan for your situation
• support you through the process.

IDCARE’s Learning Centre can help with your identity and cybersecurity concerns and teach you how to:

• prepare
• prevent
• detect
• respond.

Apply for a Commonwealth Victim’s Certificate

If your identity has been stolen, you can apply for a Commonwealth Victims' Certificate.

Use the certificate to help:

• support your claim that you have been the victim of identity crime
• re-establish your credentials with government or financial institutions.

Go to the Australian Government’s Attorney-General’s Department website to apply for a certificate.

Contact the ATO if someone has stolen your personal or business identity. You must report all tax-related security issues to the ATO.

Australian Government accounts – myGov; Centrelink, Medicare and Concession accounts

Services Australia advises your Medicare, Pensioner Concession, Healthcare Concession, and Commonwealth Seniors or Veterans DVA accounts cannot be accessed with your card numbers alone.

For more information about the security of your Medicare, Centrelink and myGov accounts and advice on how you can protect your personal information after a data breach visit protecting your personal information after a data breach.

You can visit Services Australia for helpful information about the steps you can take to replace your card.

More information about how DVA protects information in the event of data breaches is available on the DVA website.

Northern Territory Driver licence

If your Northern Territory (NT) driver licence details were included in a data breach you may not require a replacement.

Read the notification issued by the affected organisation about the licence details that were breached.

When to replace your driver licence

You must replace your licence if both of the following has been compromised:

• driver licence number at the front of the card and
• card number at the back of the card.

You don't need to replace your licence card if only your driver licence number was compromised and not the card number.

You can also replace it as a precaution if you wish.

Find out how on the Northern Territory Government (NTG) website.

To protect citizens affected by data breaches, the Australian Government has implemented new national protections including a Credential Protection Register. Read more on the NTG website.

Secure your finances

Contact your bank of financial institution to advise you have been affected by a cyber incident.

Follow their guidance on securing your account and freezing any affected accounts or cards.

If you have lost money, do not accept offers from third parties to help you get it back – this is a common tactic used by scammers to steal more money from you.

You can also access a consumer credit report or place a ban on your credit report being used as part of a credit check. Read about fraud and your credit report on the Office of the Australian Information Commissioner website.

Check and monitor for unauthorised activity

After you have secured your accounts, continue to check and monitor for unauthorised activity.

Monitor:

• social media posts in your name
• private messages, texts, or emails in your name
• bank statements for purchases you didn’t authorise
• automatic transactions that have been set up without your authorisation
• changes to your financial or banking details
• changes to how your regular mail, such as utility bills or bank statements, are received.