The Australian Productivity Commission has confirmed an incident which saw emails sent out from its noreply email that appeared to have been sent by a threat actor.
Last week, the team at Cyber Daily (David Hollingworth and myself, Daniel Croft), received emails sent from [email protected], the Productivity Commission’s automated noreply email.
However, the emails contained abnormal content, with the email sent to myself having the subject line “:(“ and simply reading “cybercriminals are not terrorists”, as well as a table which featured the words “f*** you.”
You’re out of free articles for this month
To continue reading the rest of this article, please log in.
The email also featured what appeared to be a link to a threat forum page for growingly infamous threat actor 2019.
Hollingworth’s email mentioned his name, suggesting the emails were targeted. Cyber Daily understands that other Australian media also received emails of the same kind from the noreply email address.
A day later, on June 10, the Productivity Commission confirmed the incident, stating that it was aware of the issue and had launched an investigation into the matter.
“On 9 June 2026, some members of the public received unsolicited emails from a Productivity Commission email address. Some of these emails contained identifying information that the sender implied had been taken from PC records,” the Productivity Commission wrote.
“As a result of our initial investigation into this issue, we have determined that an external third party is the source of these emails. During our review, we found no evidence that any of the identifying information used in the emails has come from the PC. The PC website does not store personal data in a way that would expose user emails, and many of the affected individuals have had no prior engagement with the PC.”
The Productivity Commission added that a vulnerability was identified and had now been patched.
“We now know that a previously undetected vulnerability on the PC website was exploited by the third party to send emails that appeared to originate from a PC email address. This vulnerability has been identified and remediated,” it added.
The Productivity Commission says it has reported the incident to the Australian Cyber Security Centre (ACSC) and has taken steps to prevent further emails.
Strangely, 2019 has not listed the Productivity Commission or made any public claims of an incident against it, making their motivation unclear.
Want to see more stories from trusted news sources?
Make Cyber Daily a preferred news source on Google.
Daniel Croft
Born in the heart of Western Sydney, Daniel Croft is a passionate journalist with an understanding for and experience writing in the technology space. Having studied at Macquarie University, he joined Momentum Media in 2022, writing across a number of publications including Australian Aviation, Cyber Security Connect and Defence Connect. Outside of writing, Daniel has a keen interest in music, and spends his time playing in bands around Sydney.