Confirmation of the unnamed commercial entity came in a statement issued on Wednesday by Cyber Security NSW Chief Cyber Security Officer Tony Chapman who said that “the data referred to in media coverage has been exposed via a commercial entity and is understood to include scanned copies of driver licences collected directly by the commercial entity from its customers.”
“The information was not provided by, nor sourced from NSW Government agencies. We do not know how long this commercial entity had this data open for and we do not know whether anybody other than the security researcher quoted in media coverage has accessed the information.”
Cyber Security NSW warned that it is “the responsibility of the commercial entity to investigate this matter and notify any customers if their data has in fact been breached”.
“Amazon Web Services has so far not provided information on the identity of the commercial entity, nor the customers that may have been affected by the breach,” Chapman said.
“There are mandatory reporting requirements under the Office of the Australian Information Commissioner that the commercial entity needs adhere to.
“Cyber Security NSW will continue to work with other organisations to seek more information about the commercial entity involved and encourage them to reach out to their customers if their information has been breached.”