Identifying data
Flood victims' data uploaded to ChatGPT in Australia
A former contractor of an Australian state authority uploaded a spreadsheet of more than 12,000 rows to ChatGPT, holding flood victims' data including health information. The authority made it public more than six months later.
On 6 October 2025 Australia's NSW Reconstruction Authority announced a data breach affecting some applicants to the Northern Rivers Resilient Homes Program. The programme was set up after the 2022 floods in northern New South Wales and funds buy-backs of flood-prone homes, contributions to rebuilding, or measures such as raising homes.
According to the authority, between 12 and 15 March 2025 a former contractor uploaded a Microsoft Excel spreadsheet to ChatGPT, a tool the authority had not authorised. The spreadsheet had 10 columns and more than 12,000 rows. The first estimate was that up to 3,000 people might be affected, with names, addresses, email addresses, phone numbers and other personal and health information. The disclosure came more than six months after the upload; the authority acknowledged that notifying people had taken time.
The authority said there was no evidence that the data had been made public or accessed by a third party, but this could not be ruled out. Cyber Security NSW is monitoring the internet and the dark web, and the NSW Privacy Commissioner was notified.
An update from March 2026 says forensic analysis confirmed 2,031 affected people. The data included general case information, contact details, addresses, dates of birth, sensitive personal information and limited financial commentary, but no driver's licence, Medicare, passport or tax file numbers. An independent review found gaps in the authority's governance, training and data security. It has since introduced its own data breach policy, an updated privacy management plan covering AI, and limits on manual data downloads from its core systems.
What can we learn from it?
What left here was not a sentence or two but a whole spreadsheet with thousands of people's data; the authority itself concluded that a rule needs technical limits beside it. Machine help with a spreadsheet can genuinely be useful; the question is with what data. When using AI for a task, the excerpt it needs is enough, without names and identifiers; a full client list or case file is not required. And an organisation should provide an approved tool and clear rules, so staff are not left to work it out alone.
Sources
- NSW Reconstruction Authority: Northern Rivers Resilient Homes Program data breach
- NSW Reconstruction Authority: Resilient Homes Program data breach
- iTnews: NSW gov contractor uploaded Excel spreadsheet of flood victims' data to ChatGPT
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]