What is the Australian Government doing to protect your identity?
The government is looking at all possible solutions to protect and reissue victims' identity documents.
The Attorney-General's Department has established a Commonwealth Credential Protection Register to help stop compromised identities from being used fraudulently (further details below). As the companies impacted provides data, issuing agencies will assess and determine whether to add credentials to the register. As at 14 October 2022, the register includes around 100,000 Australian passports. These passports can still be used for international travel.
The Australian Federal Police (AFP) has launched operations to investigate the criminal aspects of the breaches. The Australian Federal Police has also launched a joint partnership (Operation GUARDIAN) with law enforcement to combat cybercrime under the Australian Federal Police led JPC3, the private sector and industry. Operation GUARDIAN is focused on shielding affected customers, where they can be identified, and working with industry to enhance protections for members of the public. The Australian Federal Police is also monitoring online forums, including the internet and dark web, for criminals trying to exploit the breached data. The Australian Federal Police will not hesitate to take action against those who are breaking the law.
If your Medicare card details have been exposed, Services Australia will allow you to replace your Medicare card for free. If you believe there has been unauthorised activity to any of your Services Australia accounts, contact their Scams and Identity Theft Help Desk.
Credential Protection Register
The Credential Protection Register stops the verification of known compromised credentials (i.e. credentials that have been subjected to a data breach) through the Document Verification Service. This means they cannot be used for fraudulent identity verification purposes. However, this also means rightful owners will not be able to use them online. New credentials issued following the data breach will work as normal. In the interim, impacted individuals should consider using alternative credentials or speak to service providers that ask for identification for other options such as visiting the service in person to present the credential.
Prior to the establishment of the Credential Protection Register, compromised credentials would successfully verify through the Document Verification Service as real and valid identity documents belonging to real people.
The Attorney-General's Department will continue to work with key stakeholders to refine the Credential Protection Register to ensure it provides a longstanding identity recovery and resilience mechanism for all Australians.
What does this mean for you?
If you have recently had your identity credentials (i.e. Australian passport or driver licence) compromised in a data breach, the details of your compromised credential may be uploaded to the Credential Protection Register. The inclusion of your compromised credential on the Credential Protection Register is automatically done by the organisation that issues the credential based on your risk profile. You’re not required to take any action.
You should consult with the credential issuer on whether the credential should be replaced. Until replacement occurs, your credential will continue to function for the purpose it was issued (for example allow you to drive a car or travel internationally). However, your credentials will not function for the purpose of confirming your identity.
Once your compromised credential has been replaced, the details of your old credential will remain on the Credential Protection Register to ensure it cannot be used for future fraudulent verification purposes. Leaving your compromised credential on the register will have no impact on your ability to verify your new identity document.
Where can I get help if I’m a victim of identity crime?
Suspected victims of an identity crime can contact IDCARE. IDCARE is Australia and New Zealand's national identity and cyber support service.
Report a privacy breach
If you think an organisation has breached your privacy, contact them directly. If you are not happy with their response, you can contact:
If you think there is a risk of serious harm from a privacy breach, contact the Commissioner immediately.
Report an identity crime or a scam
If you think you are a victim of identity crime, contact your local police. You can also get help through IDCARE – the national identity and cyber support service for Australia and New Zealand.
Report a scam to SCAMWatch or to ReportCyber.
Report a suspected/stolen identity
If you think you are a victim of identity crime, contact your local police. You can also get help through IDCARE – the national identity and cyber support service for Australia and New Zealand.
Report a cybercrime incident or vulnerability to ReportCyber.
