NSW Online Registry Website Breach – 9,000+ Files Stolen by Hackers

In a significant cybersecurity incident, approximately 9,000 sensitive court documents have been illegally downloaded from the NSW Online Registry Website (ORW), which authorities are calling a “major data breach.” 

The attack has triggered an immediate investigation by the NSW Police State Crime Command’s Cybercrime Squad under the codename Strike Force Pardey.

The security incident was detected on Tuesday, March 25, 2025, when cybercrime detectives were alerted to unauthorized access to the ORW platform, which serves as a secure repository for both civil and criminal case information across the New South Wales court system. 

The compromised files reportedly include highly sensitive documents such as apprehended violence orders (AVOs) and legal affidavits containing the personal information of vulnerable individuals.

Details of NSW Court System Breach

NSW Attorney-General Michael Daley revealed that the breach was initially discovered during routine maintenance procedures by the Department of Communities and Justice (DCJ) cyber unit. 

“They detected that some data within that system had changed,” Daley explained. “Upon further examination, they worked out that an account holder within the JusticeLink system had gained an unlawful entry into that system.”

The investigation revealed that the threat actor had accessed 9,000 files before DCJ cybersecurity experts intervened to contain the breach. 

Experts promptly closed the user’s account and fixed the vulnerability as soon as the breach was discovered.

The DCJ has implemented immediate mitigation strategies to contain the breach and prevent further unauthorized access to the compromised system. 

Officials have confirmed that while the files were downloaded, no data has been made public as of this reporting. This suggests the attack may still be in its early stages, with the potential for data exploitation remaining a concern.

“DCJ is working to urgently identify and contact affected users and will provide updates as more information becomes available,” a department spokesperson stated. 

The breach has raised significant concerns among domestic violence and community legal services due to the sensitive nature of the compromised documents. 

AVOs, which function as restraining orders to protect victims of domestic violence and other physical harms, contain personal information that could potentially expose both victims and alleged offenders if leaked.

The full extent of the breach is still under investigation as cybercrime detectives work closely with the DCJ to assess all affected records.

The NSW government is urging anyone who believes their personal information may have been compromised to file a report through the federal government’s ReportCyber website. 

This centralized reporting system helps authorities track potential victims and provide appropriate support.

The DCJ has emphasized its commitment to data security and assured the public that it prioritizes notification to affected individuals as quickly as possible. The department continues to monitor for any signs that the stolen data might appear online.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

The post NSW Online Registry Website Breach – 9,000+ Files Stolen by Hackers appeared first on Cyber Security News.