NSW contractor uploaded flood victims' data to ChatGPT
A former contractor for NSW government's flood resilience program uploaded personal data of up to 3,000 residents to ChatGPT without authorization in March 2025. The exposed information included names, addresses, email addresses, phone numbers and health details, though there is no evidence of public access or third-party compromise as of the announcement.
What happened
Between 12 and 15 March 2025, a former contractor of the NSW Reconstruction Authority uploaded personal information from the Northern Rivers Resilient Homes Program to ChatGPT, an unsecured AI platform not authorised by the department.
The data was a Microsoft Excel spreadsheet containing 10 columns and over 12,000 rows of information. Up to 3,000 people may be potentially impacted by the breach.
Reported impact
Names, addresses, email addresses, phone numbers, and some personal and health information belonging to applicants to the Resilient Homes Program were exposed. There is no evidence that the information has been made public, however this cannot be ruled out.
Index analysis
The NSW Reconstruction Authority engaged forensic analysts and worked with Cyber Security NSW to investigate the scope and risks. The department is monitoring the internet and dark web to determine if any information is accessible online.
Governance controls
Once the full scope of the breach was understood, the NSW Reconstruction Authority took immediate steps to contain further risk and initiated an independent review of how the breach was identified and managed. The department committed to contacting impacted individuals within a week to confirm what data was shared and offer personalised support.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.