NSW Reconstruction Authority reports data breach linked to former contractor’s use of AI platform

The New South Wales Reconstruction Authority (NSWRA), a state government agency overseeing disaster recovery and rebuilding efforts, has confirmed a data breach involving personal information from applicants to the Northern Rivers Resilient Homes Program. The incident occurred in March 2025 after a former contractor uploaded sensitive data to the AI platform ChatGPT without authorization.

According to an NSWRA spokesperson, the breach took place between March 12 and 15 when the contractor uploaded a Microsoft Excel file containing more than 12,000 rows of information to ChatGPT. The file reportedly included names, addresses, email addresses, phone numbers, and other personal and health information of individuals who had engaged with the Resilient Homes Program.

“There is no evidence that any of the uploaded data has been accessed by a third party or made public,” the spokesperson said. “However, this cannot be ruled out, and a thorough investigation is underway in collaboration with Cyber Security NSW.”

Preliminary forensic analysis indicates that up to 3,000 individuals may be affected by the breach. NSWRA stated that forensic experts have been engaged to assess the scope and nature of the exposure, with results expected within days. The agency emphasized that its priority is to determine exactly what data was compromised and notify those impacted as soon as possible.

The authority, which has previously faced criticism over funding and program delays, said it is taking immediate action to contain the risk and strengthen internal safeguards. “We have reviewed and reinforced our systems and processes, and issued clear guidance to staff about the use of non-sanctioned AI tools,” the spokesperson added.

NSWRA said it is working closely with Cyber Security NSW to monitor the internet and dark web for any signs that the information has been published. The NSW Privacy Commissioner has also been notified.

Affected individuals will be contacted within the next week, with assistance from ID Support NSW, a government service offering identity protection advice and recovery resources for data breach victims. NSWRA said it will cover reasonable out-of-pocket expenses for replacing compromised identity documents.

An independent review is underway to evaluate how the breach was identified and managed. The NSWRA said it will release the findings once the investigation concludes. The results of the ongoing forensic analysis are expected to be made public later this week through The Lismore App.