PoliticalClaims.au

**What the claim gets right:** - Asylum seekers were indeed not notified that their personal information had been stolen [2] - The hard drives were not password-protected [2][3] - They were stored in an unlockable office environment [3] - The information included highly sensitive material (mental health records, abuse allegations, protection claims) [2] **Important context the claim omits:** - The theft occurred at a remote offshore facility (Nauru) operated by contractors, not in a controlled departmental office - Physical security challenges in the Nauru detention centre were significant and known - including theft of other equipment from locked cabinets [2] - The government had taken steps to improve data security after the February 2014 breach, though these didn't address the physical security issues on Nauru - The hard drives belonged to Save the Children (a contractor), which conducted its own internal investigation [2] **Why notification may not have occurred:** While the claim implies deliberate concealment, the reasons for non-notification were not fully explained by the government.