“We take the protection of customer information seriously, and we’re committed to supporting those impacted. We have contacted the Office of the Australian Information Commissioner and will continue to work with them on this matter. 

“We ask anyone who thinks they may have been affected to call us or visit their local Services Australia service centre so we can help them.”

Services Australia said that when it discovered the issue in May, it instructed the third party it uses for printing to pause production so that an investigation could be launched and to prevent further cards being issued incorrectly.

“No physical cards were issued while production was paused. Digital versions of pensioner concession cards were not impacted and continued to be issued,” Jongen said.

“We’re working to ensure those impacted receive the correct concession card as quickly as possible.”

The privacy issue comes just as Services Australia’s Centrelink agency was listed online by a threat actor claiming a cyber attack. However, Centrelink denied the incident.

As detected by threat researcher Dark Web Informer, the threat actor 2019 listed Centrelink on a cyber crime forum last week.

Based on the listing and the researcher’s findings, the data was allegedly sourced from Centrelink and seems to be related to Centrelink’s Advice of Death form, which is used to notify the agency of a person’s death so that payments can be adjusted and support for the surviving family determined.

According to the post, alleged stolen data includes the full names and dates of birth and death of deceased individuals, Medicare card numbers, Centrelink reference numbers, child support reference numbers, home addresses, Aboriginal/Torres Strait Islander descent status, relationship status, hospital addresses and details, next-of-kin details including names, phone numbers and addresses, funeral director and business details, executor/admin of estate details, and the full names, signatures and declaration dates of Advice of Death notifiers.

The threat actor 2019 claims that over 2,100 records were impacted in the alleged incident.

Responding to Cyber Daily’s request for comment, Services Australia, of which Centrelink is a part, said the agency does not comment on specific cyber security operations, but confirmed that its systems were not breached.

“Services Australia takes the protection of personal information very seriously. Our platforms and systems remain secure and have not been compromised,” a Services Australia spokesperson said.