The claim refers to a second data breach that occurred in 2014, separate from the more widely reported February 2014 incident where ~10,000 asylum seeker details were inadvertently published online [1].
**Key facts about this second breach:**
In April and May 2014, at least two external hard drives containing sensitive asylum seeker information were stolen from the Nauru Immigration Detention Centre [2][3].
The stolen hard drives:
- Were **not password-protected** [2][3]
- Contained personal details, case files, medical histories, and protection claims for hundreds of asylum seekers, including children [2]
- Included mental health and behavioral issue records, complaints about treatment, allegations of abuse, and minutes of "vulnerable minors meetings" [2]
- Were reportedly kept in an **unlockable office** accessible to any staff member at the Nauru centre [3]
The first hard drive was stolen from an office tent in April 2014.
A second hard drive containing child protection information was stolen less than a month later [2].
**Regarding notification:**
Guardian Australia reported in October 2014 that "the asylum seekers have not been told their personal information has been stolen" [2].
**The operating environment on Nauru:**
The hard drives were stolen from the Nauru Immigration Detention Centre, which was operated by contractors including Save the Children and Wilson Security, not directly by Immigration Department staff [2].
這些 zhè xiē 硬碟 yìng dié 是 shì 從 cóng 瑙 nǎo 魯 lǔ 移民 yí mín 拘留 jū liú 中心 zhōng xīn 被 bèi 竊 qiè 的 de , , 該 gāi 中心 zhōng xīn 由 yóu Save Save the the Children Children 和 hé Wilson Wilson Security Security 等 děng 承包商 chéng bāo shāng 運營 yùn yíng , , 而 ér 非 fēi 由 yóu 移民部 yí mín bù 直接 zhí jiē 管理 guǎn lǐ [ [ 2 2 ] ] 。 。
The centre had documented security challenges including:
- Equipment stored in "office tents" with limited physical security
- No secure storage for keys to storerooms and shipping containers
- Previous thefts of mobile phones, hard disks, laptops, and fans from locked cabinets [2]
**Distinction from the February breach:**
This second breach (theft of physical hard drives) was different from the February 2014 breach where the department inadvertently published data online.
The February breach affected ~10,000 people and resulted in an official Privacy Commissioner investigation that found the department had breached the Privacy Act [1][4].
**Response actions:**
After the February breach, the department did take remediation steps including:
- Engaging KPMG for a management review [4]
- Removing personal information from underlying datasets before publication
- Rolling out staff training and awareness campaigns [4]
- Committing to engage an independent auditor [4]
However, these measures did not prevent the separate physical theft incident on Nauru.
The original source is **The Guardian Australia** (October 17, 2014), a mainstream media outlet with a generally strong reputation for factual reporting.
該 gāi 文章 wén zhāng 由 yóu Ben Ben Doherty Doherty 撰寫 zhuàn xiě , , 他 tā 是 shì 一位 yī wèi 報導 bào dǎo 移民 yí mín 和 hé 尋求 xún qiú 庇護者 bì hù zhě 問題 wèn tí 的 de 資深 zī shēn 記者 jì zhě 。 。
The article was written by Ben Doherty, a respected journalist covering immigration and asylum seeker issues.
The claims in the article were based on:
- Internal correspondence obtained by the publication
- Direct statements from involved parties (Save the Children, Wilson Security)
- Legal experts (David Manne from Refugee and Immigration Legal Centre)
The Guardian's reporting on this matter was consistent with subsequent reporting by other outlets including SBS News [3].
- - 該 gāi 出版物 chū bǎn wù 獲得 huò dé 的 de 內部 nèi bù 通信 tōng xìn
The Privacy Commissioner's official investigation [4] confirmed the systemic issues with data security in the Department of Immigration and Border Protection during this period.
**Verdict on source credibility:** The Guardian is a credible mainstream source.
- - 相關方 xiāng guān fāng ( ( Save Save the the Children Children 、 、 Wilson Wilson Security Security ) ) 的 de 直接 zhí jiē 聲明 shēng míng
The specific claims in this article align with documented facts and were not disputed by the government or contractors at the time.
**Did Labor do something similar?**
Search conducted: "Labor government immigration data breach asylum seekers 2007-2013"
**Finding:** No direct equivalent data breach involving asylum seekers was found during the Labor government period (2007-2013).
* * * *
However, data security issues are a systemic challenge across Australian government departments regardless of which party is in power:
- The Privacy Commissioner's investigation into the February 2014 breach noted that the department had "policies [that] implied that it was aware of the risk of embedded personal information" but these were not effectively implemented [4].
These systemic issues predate the Coalition government.
- The offshore detention policy on Nauru was initiated under the Labor government (reopened in 2012), though the specific data security failures occurred during Coalition management of the facility [5].
- Various Australian government departments under both Labor and Coalition governments have experienced data security incidents, suggesting this is a systemic issue rather than unique to one party.
**Comparative conclusion:** While there is no direct "Labor equivalent" of this specific data breach, the underlying conditions (offshore detention infrastructure, complex contractor arrangements) were established under Labor and continued under the Coalition.
**What the claim gets right:**
- Asylum seekers were indeed not notified that their personal information had been stolen [2]
- The hard drives were not password-protected [2][3]
- They were stored in an unlockable office environment [3]
- The information included highly sensitive material (mental health records, abuse allegations, protection claims) [2]
**Important context the claim omits:**
- The theft occurred at a remote offshore facility (Nauru) operated by contractors, not in a controlled departmental office
- Physical security challenges in the Nauru detention centre were significant and known - including theft of other equipment from locked cabinets [2]
- The government had taken steps to improve data security after the February 2014 breach, though these didn't address the physical security issues on Nauru
- The hard drives belonged to Save the Children (a contractor), which conducted its own internal investigation [2]
**Why notification may not have occurred:**
While the claim implies deliberate concealment, the reasons for non-notification were not fully explained by the government.
- - 尋求 xún qiú 庇護者 bì hù zhě 確實 què shí 未 wèi 被 bèi 通知 tōng zhī 他們 tā men 的 de 個 gè 人 rén 資訊 zī xùn 已 yǐ 被 bèi 竊取 qiè qǔ [ [ 2 2 ] ]
Possible explanations include:
- Ongoing investigations (Save the Children internal review, Philip Moss independent review of Nauru conditions) [2]
- Uncertainty about what data was actually compromised
- Concerns about alarming detainees in an already volatile environment
However, the failure to notify is a serious breach of privacy best practice, and the Privacy Commissioner later (2021) ordered the department to pay compensation to victims of the separate February 2014 breach, finding that "a loss of privacy or disclosure of personal information may impact individuals" [6].
The core facts of the claim are verified: (1) asylum seekers were not informed their data had been stolen, (2) the data included sensitive information including mental health records and protection claims, (3) the hard drives were not password-protected, and (4) they were stored outside lockable store-rooms in an unlockable office.
The core facts of the claim are verified: (1) asylum seekers were not informed their data had been stolen, (2) the data included sensitive information including mental health records and protection claims, (3) the hard drives were not password-protected, and (4) they were stored outside lockable store-rooms in an unlockable office.