News

Cyber Incident

Update 14 August 2026

Kingborough Council has now written to all affected individuals to provide an update on the cyber incident and the actions taken in response.

What happened?

On 30 April 2026, Kingborough Council was alerted via an anonymous tip to a potential cyber incident. The issue was contained within approximately 40 minutes of Council being notified.

An investigation confirmed that a single unknown individual accessed information through Council’s online mapping system. The data was available in error between 18 March – 30 April 2026.

What information was involved?

The information that was accessed included: Name, Postal address, Property address and 17 unique email addresses. No other personal information was involved.

As the information was limited to contact details, the risk of misuse is considered very low. While names and property addresses are generally publicly available, Council understands the importance of keeping the community informed about incidents that may affect them. 

What action has Council taken?

Council has kept the community informed throughout its investigation and response, including providing updates on this webpage.

Following notification of the incident, Council worked with independent cyber security specialists to respond to the incident and ensure appropriate action was taken. As a precaution, the incident was reported to the Australian Cyber Security Centre (ACSC) and the Tasmanian Department of Premier and Cabinet.

The investigation confirmed that Council’s systems were not compromised. Council has also implemented sophisticated monitoring to ensure we’re aware of any further developments.

Cyber security advice:

No action is required from the persons involved. However, Council encourages everyone to follow good cyber security practices, including:

  • Be aware of email, telephone and text-based scams and refrain from sharing personal information unless you are certain about who you are sharing it with;
  • Change passwords periodically;
  • Use a password manager to remember multiple passwords;
  • Enable multi-factor authentication for online accounts where possible and keep anti-virus software up to date on any device you use to access your online accounts;
  • Avoid clicking on links in suspicious texts or emails;
  • Don’t give remote access to your computer to callers who ask for it;
  • Check your bank accounts for unusual activity and contact your bank immediately if you spot anything suspicious.

Need support?

If you have any questions, please contact Council’s Customer Service team on (03) 6211 8200.

For additional cyber safety guidance:

Council acknowledges that incidents of this nature can be concerning. Protecting community information remains a priority, and Council appreciates the community’s patience and understanding while this matter was investigated and addressed.

_______

Update 30 July 2026

Council has received the final report and recommendations from the independent external review into the cyber incident that occurred on 30 April 2026.

The review confirmed that the information involved was limited to names and property addresses, and in a smaller number of cases email addresses.

No phone numbers, financial details, identity documents or dates of birth were involved. This is consistent with the information Council first advised on 3 May 2026.

The investigation focused on establishing who accessed the information, when it was accessed and how much data was involved.

This required detailed forensic analysis and independent validation, which formed part of the external review process.

Letters will be sent by the 14 August to individuals whose personal information was included in the incident.

These letters will provide information about what occurred, the support available, and general cyber safety advice, including how to identify suspicious communications, protect online accounts and monitor for unusual activity.

Before letters can be distributed, Council is carefully reviewing and verifying contact information to ensure correspondence reaches the correct recipients.

As the affected data reflects a snapshot in time from March, some individuals may have since changed their contact details, moved address, or bought or sold property.

A summary of the incident, the findings of the review and actions taken by Council will also be published on Council’s website to ensure the community remains informed.

Council appreciates the patience and understanding shown by the community while this matter has been investigated.

While notification of this kind is not mandatory for Tasmanian councils, Council believes affected individuals should be informed about what information was involved and the steps being taken in response.

Update 29 June 2026

Council has received the independent external review report and is currently in the process of preparing a letter to residents along with a website update.

Update 4 June 2026

Council has now received a draft version of the independent external review report and is currently working with the cyber security specialists to finalise the findings. This final stage is focused on validating the scope of the data exposure and confirming the relevant technical evidence before the report is completed.

Updated 19 May 2026

Council has now completed its internal investigation and is currently awaiting the external forensic findings and legal review, which are anticipated to be received within the next 1-2 weeks.

Updated 3 May 2026

Kingborough Council was made aware on Thursday 30 April of a potential cyber incident. Access was immediately removed and an investigation was commenced, including engaging experts from across the cyber security industry to understand the nature and extent of the issue. 

The personal information primarily included:  

  • Property addresses  
  • Associated owner and occupier names  

At this stage, ongoing investigation indicates that a small number of records may have also included email addresses. No phone numbers have been identified.  

The data did not include financial details, identity documents, dates of birth, or other sensitive personal information 

Council treat matters of cyber security seriously and are currently reviewing these developments and the information provided as a priority. At this stage, our work is ongoing and we will provide further updates as they become available. 

Council is working with experts from across the cyber security industry to assist in responding to the incident and to help ensure that all appropriate action is taken. Council have also notified the Australian Cyber Security Centre (ACSC), Tasmanian Department of Premier and Cabinet, Tasmania Police and the relevant government agencies. 

“I understand the community’s concern, and I want to be clear that this matter is being taken seriously,” said CEO, Dave Stewart. 

“The information involved was limited, access has been removed, and there is no immediate evidence of misuse. 

“We are undertaking a forensic investigation and will communicate openly when we have further information. 

“I sincerely apologise for any concern that this has created in our community.” 

Our approach

Council is committed to being open and transparent with the community as this situation unfolds.

We are providing updates in real time through this page to ensure the community has access to the most current information available, while the investigation is ongoing.

At the same time, we recognise the importance of providing clear, accurate, and complete information once all facts are known.

Once the cyber investigation has concluded, Council will issue a formal letter to all affected members of the community.
This will ensure that:

  • Everyone receives consistent and confirmed information
  • Any findings from the investigation are clearly communicated
  • Appropriate advice and next steps are provided

This approach balances the need for transparency now, with the responsibility to provide accurate and verified information once the investigation is complete.

Current status

  • The data is no longer publicly accessible
  • There is currently no evidence of misuse
  • No Council systems were compromised
  • A forensic investigation is ongoing to understand the extent of access and exposure

Council will continue to update this page as more information becomes available.

________________________

Q&A (update 3 May) 

Cyber Incident: 

What has happened? 

Kingborough Council identified that data containing property, ownership and occupier information was temporarily accessible online. 

Once this was confirmed, public access was removed and the data is no longer available. 

The data wasn’t accessible through Council’s public maps by simply selecting properties on our website or browsing the Council’s maps. The data sat behind our mapping system and accessing it would have required a level of technical knowledge beyond typical website use. 

Investigations are ongoing to fully understand how the data may have been accessed during this period. 

Who has this affected? 

The data relates to all residential property owners and occupiers within the Kingborough Municipality. 

Investigations are ongoing to better understand the level of exposure. 

What was accessed? 

The personal information primarily included: 

  • Property addresses 
  • Associated owner and occupier names 

At this stage, ongoing investigation indicates that a small number of records may have also included email addresses. No phone numbers have been identified. 

The data did not include financial details, identity documents, dates of birth, or other sensitive personal information. 

Property ownership information of this kind is not unique to Council and can be accessed through other means, such as purchasing property ownership details via the Tasmanian Government’s The LIST service. However, those services typically require individual property searches and do not include contact details such as email addresses or phone numbers. 

In this case, the dataset brought some of this information together in one place. 

No Council systems were compromised, and there is no evidence that data was altered. 

Council can confirm the data contained approximately 26,000 records representing properties across the municipality. A forensic investigation is underway, with further updates to be provided as more information becomes available. 

Council has identified the individuals whose email addresses have been included and will contact those affected directly. 

Advice for the community 

Based on current information, this appears to involve limited access to the data. 

Council will contact directly any individuals whose email addresses may have been included in the dataset. 

Anyone with concerns is encouraged to contact Council: 

  • Phone: 6211 8200 

Why did this happen? 

There is no evidence of malicious intent or a cyber-attack. 

The exposure occurred as a result of a technical configuration issue, not deliberate misuse or external intrusion. This is an isolated incident. 

The CEO has held initial discussions with Tasmania Police regarding the incident and appropriate next steps. 

Important advice for anyone who has accessed this data 

If you have accessed, downloaded, or been provided with this information, you should: 

  • Delete the data in full 
  • Not copy, share, or distribute the information in any way 
  • Not use the information to contact individuals 

Unauthorised use or distribution of personal information may breach obligations under the Privacy Act 1988 and other applicable laws. 

How did we find this out? 

Council became aware of the issue on 30 April 2026 after it was brought to the attention of the CEO. 

An immediate investigation was commenced, and public access to the data was removed promptly to contain the issue. 

Once contained, Council engaged its cyber insurance provider, independent cyber security specialists, and legal advisors to support a formal investigation. 

Council is also working through its obligations to notify relevant regulatory bodies and will make any required notifications in line with applicable legislation. 

What guarantee do we have that this won’t be used maliciously? 

Council cannot provide an absolute guarantee.
However: 

  • The dataset was limited in nature 
  • Only a small subset of records may have included email addresses 
  • No phone numbers have been identified 
  • It did not include financial details, identity documents, or dates of birth 

There is currently no evidence that the information has been misused. 

Council is continuing forensic analysis to better understand access to the dataset. 

Have we fixed the issue? 

Yes. The immediate issue has been addressed: 

  • Public access to the dataset has been removed 
  • Initial checks confirm the data is no longer externally accessible 
  • Specialist technical, legal and insurance support has been engaged 

These actions were taken promptly once the issue was identified. 

What are we doing to ensure this doesn’t happen again? 

Council is: 

  • Conducting a forensic technical review 
  • Reviewing change management processes 
  • Strengthening internal governance around data management 

Further updates will be provided once the investigation is complete, in line with our commitment to transparency. 

Use and Risks of Exposed Information 

The information involved was primarily names and property addresses. Ongoing investigation indicates that a small number of records may have also included email addresses. No phone numbers have been identified.  

It did not include financial details, identity documents, dates of birth, or other sensitive data. 

On its own, this type of information presents a relatively low risk. While email addresses may increase the likelihood of unwanted contact, they are not sufficient to enable identity theft or financial fraud. 

However, any unauthorised access to personal information is a concern. In some cases, this information could be used alongside other data to support unwanted contact, such as scams or marketing. 

At this stage, there is no evidence that the information has been misused. 

Access to the data has been removed, and Council is continuing to investigate with support from technical and legal specialists. 

Council will contact directly the small number of individuals whose email addresses were included to ensure they are aware and supported. 

We encourage community members to remain vigilant and report any suspicious activity. 

If you have accessed or obtained this information, you should: 

  • Not share, distribute, or publish the data 
  • Delete any copies you may have saved 
  • Not use the information to contact individuals 
  • Notify Council to support the investigation 

While the Privacy Act 1988 (Cth) primarily regulates how organisations handle personal information, not individuals, any further use or distribution of this data may cause harm and could have legal implications under other laws. 

Council appreciates the community’s cooperation in handling this matter responsibly.