The Australian Human Rights Commission (AHRC) has experienced a data breach potentially impacting numerous individuals who submitted their complaints through its online form.

The AHRC first became aware of an “unauthorised disclosure” of about 670 documents uploaded to the complaint form online on April 10.

This is believed to have happened between March 24 and April 10.

It is estimated that approximately 100 of these documents were unintentionally made publicly accessible and indexed on search engines like Google or Bing from April 3 to May 10.

These documents included sensitive personal details such as full names, email and residential addresses, mobile numbers, employers and job titles, work contact details, personal health data, education details, religious affiliations, and photos.

Last week, the AHRC learnt that documents uploaded online for the AHRC’s Speaking from Experience project, Human Rights Awards 2023 nominations and the National Anti-Racism Framework concept paper had also been breached between April 3 and May 5. 

The AHRC is unable to confirm just how many people have been affected.

“The Commission acted to address the breach as soon as it came to our attention. We sincerely apologise for any distress or harm this data breach may have caused,” it said.

The AHRC said the disclosure was not the result of a malicious or criminal attack.

A taskforce has been established to investigate the breach and prevent any further access to the affected documents. 

All online forms have been disabled in the meantime, with complainants advised to fill out a PDF or Microsoft Word version of the form and return it to the AHRC by email or post.

“We have treated this data breach with the highest level of concern and are carrying out a thorough and comprehensive investigation and review of the impacted data, with the support of our experts,” the AHRC said.

”We have taken action to address the disclosure including having relevant documents removed from search engines.”

The AHRC believes the breach affected anyone who:

The AHRC will notify those who are affected.

Anyone who believes they have been affected can also contact the AHRC.