-
Hackers posted sensitive Victorian court records on the dark web, including names and emails of online hearing participants from regional courts for a period of four years.
-
The leaked data contains highly-sensitive details from the hearings on intervention order of family violence and cases in children’s court cases, with the forum user claiming to have acquired 28,600 lines of records.
-
Victoria Police is investigating the breach, and Court Services Victoria has notified the Information Commissioner and Australian Cyber Security Centre while advising affected individuals to contact police or victim support services.
Hackers have posted sensitive court records from regional Victoria on the dark web. The leaked information includes names and emails of online hearing participants. Court Services Victoria confirmed the breach affected Magistrates’ and Children’s Court divisions.
The data spans from the past four years till this year – it covers hearings in Castlemaine, Kerang, Bendigo, Echuca, Kyneton, Mildura, Maryborough, Robinvale, Ouyen, and Swan Hill.
The forum user who posted the material claimed to have acquired 28,600 lines of court records. A small sample of the information appears to show metadata from the WebEx system of the court, which stores online hearings.
Also, the ABC knows that some of the exposed data includes sensitive details, including the names of parties involved in the hearings of family violence intervention order and children’s court cases.
Victoria Police’s cybercrime squad is now investigating the breach. The Victorian Information Commissioner and the Australian Cyber Security Centre have also been notified.
Court Services Victoria has advised people concerned for their safety to contact police or victim support services.
What Data was Exposed
The leaked data consists of names, email addresses, and job positions of individuals who participated in online trials in various regional courts. Additionally, some publicly-accessed data, such as case names and courtrooms, is part of the leaked data.
Some of the records contain highly-sensitive details from family violence intervention order hearings. Children’s court cases were also among the exposed information.
The data came from the WebEx system of the court, which hosts online hearings. The sample appears to show metadata taken from this platform. This includes information about who attended hearings and when they participated.
The breach impacts hearings at various regional places, which includes Bendigo, Castlemaine, Echuca, Kerang, Kyneton, Maryborough, Mildura, Ouyen, Robinvale, Swan Hill, etc. The period affected includes hearings from 2022 till 2026.
The exact number of impacted individuals remains unknown. Court Services Victoria stated that in many instances, the information was inaccurate, incomplete, and complex. The organization has been unable to verify the total number of impacted individuals.
Previous Security Incidents
Victorian courts have experienced some security issues previously. A ransomware cyber-attack occurred two years ago, which was thought to be from Russian hackers. The attackers hacked the court systems and demanded money for restoring the access to the systems.
In 2021, the Children’s Court accidentally posted case details online. The ABC alerted the court to the apparent breach of the law. The court had hosted a webpage which contains court lists but allows public access. The page was immediately removed once discovered. The court launched an investigation into how the information became available.
The current dark web forum user allegedly said they had also obtained customer data from other Australian organizations. These include a travel company and the Melbourne International Film Festival. In June, MIFF confirmed a ticketing hack likely impacted about 26,700 customers.
Growing Concern Over Court Data Security
The recent incident of data leakage raises some serious questions regarding the protection of court data. Notably, the coronavirus outbreak led to the increasing use of online events in courtrooms around the country. The growing reliance on digital information technologies, however, means that there are new types of security challenges.
Indeed, video conferencing tools have specific security hazards. In particular, metadata may disclose information about everyone involved in the process of adjudication. This information, in turn, is valuable to cybercriminals.
As online hearings are becoming more popular, it is important to make sure that all the necessary precautions are in place when organizing events of this kind. Some safety measures may involve the use of encryption tools and limiting the number of people who can access data files. Also, regular security audits can help organizations to identify vulnerabilities before attackers can exploit them.
The consequences of exposed personal data in Victoria have already been demonstrated. In May 2026, a Lynbrook man was recently jailed for stealing 1,500 identities and using them in a bulk phone porting scam, successfully hijacking 44 victims’ phone numbers to bypass multi-factor authentication and access bank accounts.
