Resilient Homes Program data breach

The NSW Reconstruction Authority (RA) is aware of a data breach involving personal information belonging to some people who applied for the Northern Rivers Resilient Homes Program (RHP).

The breach occurred when a former contractor of the RA uploaded data containing personal information to an unsecured AI tool which was not authorised by the department.

There is no evidence that any information has been made public, however, Cyber Security NSW will continue to monitor the internet and the dark web to see if any of the information is accessible online.

We understand this news is concerning and we are deeply sorry for the distress it may cause for those who have engaged with the program.

We will be contacting people in the coming days with updates to let them know what has happened and whether they have been impacted or not.

Since learning about the extent of this breach, we have engaged forensic analysts and are working closely with Cyber Security NSW to understand the scope and the risks arising from it.

We expect the forensic analysis to be completed within the coming days. This will give us a clearer understanding of the extent of the breach and the specific data involved.

We know people will want to know exactly what has been shared and we are doing all we can to get that information to them as soon as possible.

So far, there is no evidence that any of the uploaded data has been accessed by a third party.

What happened?

Between 12 and 15 March 2025, personal information held for the Resilient Homes Program (RHP) was uploaded to the AI platform ChatGPT by a former RA contractor.

Once we understood the full scope of the breach, we took immediate steps to contain any further risk. We engaged forensic analysts, began working closely with Cyber Security NSW and commenced inquiries to determine what was shared, what risks may exist, and who was affected.

The data involved was a Microsoft Excel spreadsheet containing 10 columns and over 12,000 rows of information. Every row is being carefully reviewed to understand what information may have been compromised.

This process has been complex and time-consuming and we acknowledge that it has taken time to notify people. Our focus has been on ensuring we had the right information to contact every impacted person accurately and completely.

We understand people will have questions about how this happened and why notification has taken time. To help answer those questions, we’ve initiated an independent review.

What we know

Based on early forensic analysis, up to 3,000 people may be potentially impacted.

At this stage, the information we know that has been disclosed includes:

• Names and addresses
• Email addresses
• Phone numbers
• Some personal and health information

What we are doing

Within a week, we will contact anyone impacted to confirm exactly what data was shared and offer personalised support.

We're working with Cyber Security NSW to monitor the internet and dark web for any signs that this information is accessible online. Continuous monitoring of the dark web and broader internet is ongoing and to date, there is no evidence that any uploaded data has been accessed or distributed by a third party.

The NSW Privacy Commissioner has been notified and we’ve reviewed and strengthened our internal systems and processes and issued clear guidance to staff on the use of unauthorised AI platforms, like ChatGPT. Safeguards are now in place to prevent similar incidents in future.

What support is available?

To speak to someone on the phone about what has happened please call the RHP call centre on 1800 844 085 Monday to Friday, 9am-5pm (excluding public holidays).

RA will provide compensation for any reasonable out of pocket expenses if any compromised identity documents need to be replaced.

If you have any concerns about protecting your identity, NSW government agency ID Support can help prevent and recover from data breaches with expert advice, free resources and support. You can reach them via their website www.nsw.gov.au/id-support-nsw or call them on 1800 001 040, Monday to Friday, 9am-5pm (excluding public holidays). Interpreter services are available.

ID Support NSW can help by

• providing advice on compromised identification documents and how to restore your identity security
• guiding you on how to keep your personal identity information safe
• sharing options for additional support and counselling services.

We will continue to share updates and provide support to those who have been impacted.

We understand the seriousness of this breach and are deeply sorry for the potential impact on people. We remain fully committed to protecting their privacy and restoring trust in the Resilient Homes Program and the RA.

Frequently asked questions