HWL Ebsworth data breach update

The National Disability Insurance Agency (NDIA) is aware of a cyber incident impacting HWL Ebsworth. 

Some NDIS participants, prospective participants, their families and carers, and staff have been impacted by this breach. 

We recognise this may be distressing for affected individuals. 

While the NDIA’s systems have not been compromised, HWL Ebsworth is an external law firm that provides legal services to private clients and government agencies, including the NDIA. 

Please be assured the NDIA is taking this matter extremely seriously and are taking measures to protect participant data and information security. We sincerely apologise for any distress caused.

Only participants or prospective participants with NDIA legal matters represented by HWL Ebsworth have the potential to be affected. When the NDIA engages an external legal firm to appear in an AAT matter, they will write to you or your representative to let you know and provide contact details.

The NDIA is working closely with HWL Ebsworth to ensure those affected are appropriately identified, notified and supported as we confirm what information has been affected.

All impacted participants and prospective participants will be directly contacted by the NDIA.

The NDIA is taking additional precautions to protect potentially impacted individuals including actively monitoring plans and account transactions for any unusual or suspicious activity. 

If you are concerned your data may have been accessed, please call the NDIA on 1300 216 807.

The NDIA is working closely with HWL Ebsworth and other affected government agencies, including law enforcement, to limit the impact on participants.

HWL Ebsworth has reported the data breach to the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches (NDB) scheme. 

Read "Protecting your personal information after a data breach" for further information how you can protect your personal information after a data breach.

*Please note, some language in the web statement was updated on 7 August to ensure clarity.