The Australian Human Rights Commission (AHRC) has revealed a data breach incident in which private documents were leaked online and indexed by major search engines.
See also: Dior reveals customer data breach
Many of the hundreds of documents exposed contained sensitive and personal information, including names, contact details, health information, education, religion, professional details and photographs.
The AHRC is an independent statutory body established by the Australian Government, with a primary role in promoting and protecting human rights in the country. The Commission receives and investigates complaints of discrimination, monitors compliance with international human rights obligations, conducts research and studies, and oversees related projects and initiatives.
Although the organization does not have judicial powers, it receives complaints from the public and seeks to resolve them through conciliation, while unresolved cases are referred to federal courts.
According to a notice published on the AHRC website, the breach concerns submissions made during the following periods:
- Through the online complaint form, between March 24, 2025 and April 10, 2025
- As part of the project "Speaking from Experience", between March 2024 and September 2024
- About the idea paper for the National Framework Against Racism, between October 2021 and February 2022
See also: Twilio denies breach and Steam password leak
In total, 670 documents were exposed online and compromised between April 3 and May 5, 2025.
While some documents contained previously published personal information, others revealed sensitive datathat could be damaging to the individuals who submitted them, given the sensitive nature of the issues the AHRC deals with. The organisation said the incident was not the result of a malicious external attack, and further details are expected to be released in a future update.
At the same time, the AHRC requested the immediate removal of the indexed files from search engines and disabled all online submission forms, in order to prevent a new leak due to underlying configuration issues.
A task force has been established and an investigation is underway, and the Office of the Australian Information Commissioner (OAIC) has been notified. Those found to have been affected by the incident will be notified personally, and a hotline has been set up to provide assistance.
In addition to the usual recommendations to watch out for scams or suspicious activity, the AHRC also provides links to platforms , recognising the psychological toll such a breach can take on those involved.
See also: Marks & Spencer: Cyberattack led to data breach
In light of the above, the incident with the Australian Human Rights Commission (AHRC) highlights the seriousness of a data breach, especially when it involves an organisation that handles sensitive personal information of people who are often in vulnerable positions — such as victims of discrimination, racism or human rights abuses. The incident also highlights the importance of properly managing and protecting digital infrastructure in public organisations — especially where we are entrusted with our data to protect and defend our rights.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: bleepingcomputer
