www.smh.com.au Open in urlscan Pro
2a04:4e42:600::645  Public Scan

Form analysis
4 forms found in the DOM

<form class="_3b67L"><label for="site-search">Search Site</label><input class="_2q19s" id="site-search" name="query" placeholder="Search" type="search" value=""><input class="JaNbC" data-testid="search-submit" type="submit" value="Search"></form>

Name: googleSignIn —

<form id="googleSignIn" name="googleSignIn"><button class="_3oI1J" data-testid="google-sign-in" form="googleSignIn" type="submit" value="Continue with Google"><span>Continue with Google</span></button></form>

Name: appleSignIn —

<form id="appleSignIn" name="appleSignIn"><button class="_3GVET" data-testid="apple-sign-in" form="appleSignIn" type="submit" value="Continue with Apple"><span>Continue with Apple</span></button></form>

Name: registrationPrompt — POST

<form method="POST" name="registrationPrompt"><label for="registration-email-address">Email address</label><input class="_2Lk-B _2N9eJ" data-testid="registration-email-address" id="registration-email-address" name="registrationEmail"
    placeholder="e.g. J.Citizen@gmail.com" required="" type="email" value=""><button class="_2ruks" data-testid="registration-continue">Continue</button>
  <p class="_118JB" role="alert"></p>
</form>

Text Content

Sensitive business addresses among 500,000 published in COVID data breach


We’re sorry, this feature is currently unavailable. We’re working to restore it.
Please try again later.

Dismiss
Skip to sections navigationSkip to contentSkip to footer
 * Our network
 * SubscribeLog in

Open NavigationMenu


THE SYDNEY MORNING HERALD

Subscribe


THE SYDNEY MORNING HERALD

close
Search Site
 * Sections
 * Network

 * Home
 * Sydney
 * NSW
 * PoliticsHide subsections
   * Federal
   * NSW
   * Victoria
   * Queensland
   * Western Australia
 * BusinessShow subsections
   * Companies
   * Markets
   * The economy
   * Banking & finance
   * Entrepreneurship
   * Media
   * Workplace
 * WorldShow subsections
   * North America
   * Europe
   * Asia
   * Middle East
   * Oceania
   * South America
   * Africa
 * NationalShow subsections
   * Victoria
   * Queensland
   * Western Australia
 * Opinion
 * PropertyShow subsections
   * News
   * Title Deeds
   * Living
   * Auctions
   * Financing
 * SportShow subsections
   * NRL
   * Rugby union
   * Cricket
   * Soccer
   * AFL
   * Racing
   * Tennis
   * Netball
   * Basketball
   * Motorsport
   * Cycling
   * Golf
   * NFL
   * Athletics
   * Swimming
   * Boxing
 * CultureShow subsections
   * Movies
   * TV & radio
   * Music
   * Celebrity
   * Books
   * Comedy
   * Dance
   * Musicals
   * Opera
   * Theatre
   * Art & design
   * TV guide
 * LifestyleShow subsections
   * Health & wellness
   * Fashion
   * Life & relationships
   * Beauty
   * Style
   * Horoscopes
 * Good Weekend
 * Spectrum
 * Sunday Life
 * MoneyShow subsections
   * Super & retirement
   * Investing
   * Banking
   * Borrowing
   * Saving
   * Tax
   * Planning & budgeting
   * Insurance
 * Education
 * Healthcare
 * EnvironmentShow subsections
   * Conservation
   * Climate change
   * Sustainability
   * Weather
 * TechnologyShow subsections
   * Video games
   * Home tech
   * Phones
   * Gadgets
 * Drive
 * Traveller
 * Good Food

 * PREMIUM
   
   Subscribe
 * Today’s Paper
 * Daily Crosswords & Sudoku

 * MORE

 * Letters
 * Editorial
 * Column 8
 * Obituaries
 * Explainers
 * Quizzes
 * Weather

 * The Sydney Morning Herald
 * The Age
 * Brisbane Times
 * WAtoday
 * The Australian Financial Review

 * Domain
 * Commercial Real Estate
 * Drive
 * Good Food
 * Traveller

Advertisement

 * Exclusive
 * Politics
 * Federal
 * Information security

This was published 9 months ago


SENSITIVE BUSINESS ADDRESSES AMONG 500,000 PUBLISHED IN COVID DATA BREACH

BY JONATHAN KEARSLEY AND CLAIR WEAVER

February 14, 2022 — 7.00pm
Save
Log in, register or subscribe to save articles for later.
Share
Normal text sizeLarger text sizeVery large text size
43

View all comments

Advertisement


The addresses of more than 500,000 organisations including defence sites, a
missile maintenance unit and domestic violence shelters were inadvertently made
public in the first major breach of the NSW government’s massive trove of QR
code data.

Premier Dominic Perrottet said the information was uploaded in error and the
bungle, which has alarmed privacy advocates and women’s safety advocates,
“shouldn’t have happened”.



NSW Premier Dominic Perrottet says he was advised of “an issue” on Monday
morning.Credit:James Alcock

Cybersecurity experts have long warned the huge amount of data being collected
by governments through QR code systems was vulnerable to security breaches, data
fraud and hacking.

The locations, collected by the NSW Department of Customer Service when
businesses and organisations registered as COVID-safe to access a QR code for
staff and customers to check in, were discovered on a NSW data website in
September by technology specialist Skeeve Stevens.



He alerted cyber experts who raised the alarm with the NSW government. It
referred the matter to the privacy commissioner the following month and a
spokesman said it was told it “did not constitute a privacy breach”.


RELATED ARTICLE

CORONAVIRUS PANDEMIC


‘THIS MUST NOT BE PERMANENT’: PRIVACY EXPERTS SOUND ALARM OVER QR CODES

Mr Perrottet said he was advised of “an issue” on Monday morning.

“That was worked through [by the] privacy commissioner. My understanding is they
were satisfied that the matter was resolved and that information was taken down.
It shouldn’t have happened,” Mr Perrottet said.

The list of addresses included correctional facilities, critical infrastructure
networks including power stations and tunnel entry sites as well as dozens of
shelters and crisis accommodation centres for women across the state.

Advertisement


The NSW Department of Customer Service said it classed fewer than 1 per cent of
the 566,318 locations as sensitive.

COVID-safe registration was open to all businesses, including those in other
states and territories that had interests in NSW. Locations in Western
Australia, Queensland, Victoria, South Australia and the ACT were also in the
dataset seen by this masthead.

Video Player is loading.

Play Video
Play
Mute

Current Time 0:00
/
Duration 0:00
Loaded: 0%

0:00
Stream Type LIVE
Seek to live, currently behind liveLIVE
Remaining Time -0:00
 
1x
Playback Rate

Chapters
 * Chapters

Descriptions
 * descriptions off, selected

Captions
 * captions settings, opens captions settings dialog
 * captions off, selected

Audio Track

Fullscreen

This is a modal window.



Beginning of dialog window. Escape will cancel and close the window.

TextColorWhiteBlackRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-TransparentBackgroundColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-TransparentTransparentWindowColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyTransparentSemi-TransparentOpaque
Font Size50%75%100%125%150%175%200%300%400%Text Edge
StyleNoneRaisedDepressedUniformDropshadowFont FamilyProportional
Sans-SerifMonospace Sans-SerifProportional SerifMonospace SerifCasualScriptSmall
Caps
Reset restore all settings to the default valuesDone
Close Modal Dialog

End of dialog window.

Close Modal Dialog

This is a modal window. This modal can be closed by pressing the Escape key or
activating the close button.


Play
Mute

Current Time 0:00
/
Duration 0:00
Loaded: 0%


Stream Type LIVE
Seek to live, currently playing liveLIVE
Remaining Time -0:00
 
1x
Playback Rate

Picture-in-PictureFullscreen
Loading


AUDIT REVEALS QR CODE DATA KEPT LONGER THAN STATED BY GOVERNMENT

Replay


AUDIT REVEALS QR CODE DATA KEPT LONGER THAN STATED BY GOVERNMENT

Replay video
Play video

1:42


AUDIT REVEALS QR CODE DATA KEPT LONGER THAN STATED BY GOVERNMENT

Up Next


YOU HAVE NO IDEA WHAT IT'S LIKE: LIBERAL MP

Play video


The Auditor General's office in Adelaide has revealed QR code data has been
stored longer than the six-month period advised by the state government.

“These businesses were all contacted by telephone and letter. No issues of
concern were raised by any recipients,” a department spokesperson said.

A domestic violence victims’ support advocate said the leak “could be a matter
of life and death”.



“If the government is really sharing information like this it can have serious
consequences,” Full Stop Australia chief executive Hayley Foster said.


RELATED ARTICLE

EXCLUSIVE

CORONAVIRUS PANDEMIC


‘BREACH OF TRUST’: POLICE USING QR CHECK-IN DATA TO SOLVE CRIMES

A notice on the NSW data website dated October 12, 2021, says: “The COVID Safe
Businesses and Organisations dataset has been discontinued. We have identified
issues with integrity of the data.”

Neither the department nor the government have explained what the “integrity”
issue was.

A department spokesperson said it considered the security and privacy of
customer information its highest priority.



“The list of COVID Safe businesses was publicly available online to ensure
customers could plan activities while remaining COVID Safe,” it said. “Those
registering were advised the Department of Customer Service may share
de-identified information for research and statistical purposes.”

But Mr Stevens, who works in the security and intelligence space, said the
database could have been used for “bad things” if the wrong people had got hold
of it.


EDITOR'S PICK

EXPLAINER

CYBERSECURITY


HACKERS CAN STOP THE TRAINS AND THE LIGHTS. BUT COULD THEY START A WAR?

“Some of the scary things we were searching [was] firearms, armoury, federal
police and where storage locations were ... perhaps someone should’ve thought
about what should and shouldn’t have been disclosed,” he said.

Civil libertarian Terry O’Gorman questioned why the information was made
available in the first place and said if there had been a significant breach,
the relevant state government department should be prosecuted.



“It just boggles the mind as to why there’s even a necessity to publish this
sort of information,” he said.

Fascinating answers to perplexing questions delivered to your inbox every week.
Sign up to get our new Explainer newsletter here.

CLARIFICATION

An earlier version of this article referred to Hayley Foster as chief executive
of Women’s Safety NSW. Her title is in fact CEO of Full Stop Australia. 


Save
Log in, register or subscribe to save articles for later.
Share
License this article
 * Information security
 * Privacy
 * Dominic Perrottet
 * Coronavirus pandemic

Jonathan Kearsley is a political reporter for Nine News in Canberra.Connect via
Twitter or email.
43

View all comments


MOST VIEWED IN POLITICS


‘ADDICTED TO POWER’: SCOTT MORRISON ATTACKED BY CLOSEST ALLY


‘FORCED TO MOVE AWAY FROM FAMILY AND FRIENDS’: RENTAL AFFORDABILITY SLIDES

OPINION


WILL SCOTT MORRISON EVEN CARE WHEN HE IS CENSURED?


DUTTON’S NIGHTMARE MORRISON PROBLEM IS ALSO AN OPPORTUNITY


‘EMOTIONAL BLACKMAIL’: NATIONALS TO OPPOSE VOICE TO PARLIAMENT IN BLOW TO
REFERENDUM


SCOTT MORRISON TO BE CENSURED BY PARLIAMENT

SMH RECOMMENDS
Money Cost of living: Should you revisit your home loan? Consecutive interest
rate rises hit the household budget hard.
SMH Fame and Flashdance singer-actor Irene Cara dies at 63 Tributes have poured
in for the New York-born star who was behind some of the most joyful,
high-energy pop anthems of the early 1980s.
National Runaway car hits pub and smashes a rural village’s renaissance The
village of Apsley has long relied on its pub as its only social hub. But an
out-of-control car has left the new owners and village residents devastated.

Promoted

RAID: Shadow Legends 今最高のフリーゲーム。インストール不要。無料でプレイ！
Top Saving Deals Here Are 33 of the Coolest Gifts in 2022
Shop Now
jxlf168 電気彫刻ペン、コンパクトサイズ、研磨、切断、穴あけ、彫刻、除染、USB接続、どこでも使える快適なグリップ。

Mansion Global Discover the Most Expensive Homes in Miami
Mansion Global Deshaun Watson Buys $5.4 Million English-Style Mansion Outside
Cleveland
Mansion Global Steeped in Culture and History, Cannes Offers an Active
Retirement on the Beautiful French Riviera
Mansion Global This Week in Celebrity Homes: Christian Slater, Alyson Hannigan
and Alexis Denisof
WSJ Custom Studios How NTT Is Accelerating Technological Innovation Through
Collaboration
Teeth Care Incredible toothbrush is all the rage in Japan
「ティップアンドトリック」 3秒で卵の殻をむく事ができる超簡単な衝撃トリックを紹介！
「ティップアンドトリック」 指の形であなたの性格が分かる？皆さんの指の形はどのタイプですか？
Life Tech Adviser Japan: New "Lung Cleaning" Device is Going Viral


Thank you for reading the Herald. This article is complimentary.

Register or log in now to read more articles and unlock extra benefits.

No payment required

Read more
Continue with Google
Continue with Apple

or

Email addressContinue



By continuing, you agree to your personal information being collected under our
privacy policy and accept our terms of use.

Hide content


FROM OUR PARTNERS

Loading 3rd party ad content
Loading 3rd party ad content

Loading 3rd party ad content
Loading 3rd party ad content

Advertisement




THE SYDNEY MORNING HERALD

 * Twitter
 * Facebook
 * Instagram
 * RSS


OUR SITES

 * The Sydney Morning Herald
 * The Age
 * Brisbane Times
 * WAtoday
 * The Australian Financial Review
 * Domain
 * Traveller
 * Good Food
 * Drive


CLASSIFIEDS

 * Tributes
 * Celebrations
 * Place your ad
 * Commercial Real Estate


THE SYDNEY MORNING HERALD

 * Contact & support
 * Advertise with us
 * Newsletters
 * Accessibility guide
 * Sitemap
 * Photo sales
 * Purchase front pages
 * Content licensing
 * Our events
 * Work with us
 * Terms of use
 * Privacy policy
 * Press Council
 * Charter of Editorial Independence


PRODUCTS & SERVICES

 * Subscription packages
 * My account
 * Subscriber FAQs
 * Delivery status
 * Today’s Paper
 * Daily Crosswords & Sudoku

Copyright © 2022

Subscribe