NSW Reconstruction Authority: Personal Information of 2,031 Resilient Homes Program Applicants Uploaded to ChatGPT (March 2025)

Summary

The NSW Reconstruction Authority (RA) said that between March 12 and 15, 2025, a former member of its temporary workforce (described as a former contractor in the RA's October 2025 release and as a former temporary staff member or employee in later updates) uploaded a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows, holding personal information from applicants to the Northern Rivers Resilient Homes Program, to ChatGPT, an AI tool the RA had not authorised. The RA announced the breach on October 6, 2025, acknowledging that notifying people had taken time, and external forensic analysis later confirmed that 2,031 people had some of their data uploaded: names and contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary, but no banking details or driver's licence, Medicare, passport or Tax File Numbers. The RA said it was not a cyber-attack, that it had found no evidence the data was publicly available or accessed by a third party, and that it reported the breach to the NSW Privacy Commissioner, contacted affected people with ID Support NSW, and worked with Cyber Security NSW to monitor the internet and dark web. It has since blocked uploads of personal information into AI tools and, after an independent review found areas for improvement in its governance, training and data security practices, limited manual data downloads in core systems and improved system access permissions. These facts are as the RA reported them.

Consequence

• Personal information of 2,031 Resilient Homes Program applicants uploaded to ChatGPT, as confirmed by external forensic analysis
• Breach reported to the NSW Privacy Commissioner under the Privacy and Personal Information Protection Act 1998
• Independent review completed, identifying areas for improvement in the RA's governance, training and data security practices
• RA implemented controls to block the upload of personal information into AI tools

Who caught it Not reportedFound outside the organization

Key dates

1. March 12, 2025Event
2. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 21, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Between 12 and 15 March 2025, personal information was uploaded by a former contractor of the RA to the Artificial Intelligence platform ChatGPT.

   Supports: who, what and when: a former contractor uploaded personal information to ChatGPT, March 12-15, 2025

   The breach occurred when a former contractor of the RA uploaded data containing personal information to an unsecured AI tool which was not authorised by the department.

   Supports: the tool was not authorised by the RA

   The data shared was a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of information.

   Supports: the data: a spreadsheet of 10 columns and more than 12,000 rows

   Published: 6 October 2025

   Supports: announcement date October 6, 2025

   The process is highly complex and time consuming and we acknowledge that it has taken time to notify people.

   Supports: the RA acknowledged that notification took time

   Northern Rivers Resilient Homes Program data breach NSW Reconstruction Authority (departmental media release, October 6, 2025) Primary source

2. 2031 people who provided information to the RA for the RHP had some of their data uploaded to ChatGPT.

   Supports: consequence: 2,031 people affected, confirmed by external forensic analysis

   The breach occurred when a former temporary staff member of the RA uploaded data containing personal information to an unsecured Artificial Intelligence (AI) tool which was not authorised by RA.

   Supports: later description of the uploader as a former temporary staff member

   Importantly, we can confirm that no driver's licence numbers, Medicare numbers, passport numbers, or Tax File Numbers were disclosed in the breach.

   Supports: identity document numbers were not disclosed

   the breach was reported to the NSW Privacy Commissioner.

   Supports: consequence: breach reported to the NSW Privacy Commissioner

   An independent review into the data breach has now been completed, identifying several areas for improvement in RA’s governance, training and data security practices.

   Supports: consequence: independent review completed and its findings in summary

   Limiting manual data downloads in core systems such as SmartyGrants

   Supports: remediation: limits on manual data downloads

   The RA has also implemented controls to block the upload of personal information into AI tools.

   Supports: remediation: upload-blocking controls for AI tools

   There is no evidence that any of the uploaded data is publicly available online or has been accessed by a third party at this stage.

   Supports: no evidence of publication or third-party access (RA's statement)

   This incident occurred when a former temporary employee uploaded information from a Microsoft Excel spreadsheet to an unauthorised third-party AI platform, ChatGPT.

   Supports: not a cyber-attack; the upload of a spreadsheet to ChatGPT

   Improving cyber security and system access permissions.

   Supports: remediation: improved access permissions

   Resilient Homes Program data breach NSW Reconstruction Authority (NSW Government breach information page, last updated March 26, 2026) Primary source

3. The breach occurred when a former contractor of the RA uploaded data containing personal information to an unsecured AI tool (ChatGPT).

   Supports: contemporaneous secondary report of the October 2025 announcement

   NSW Reconstruction Authority reveals serious data breach GovTech Review (October 7, 2025) Reporting or analysis