Fresh details about last year’s Resilient Homes Program data breach have emerged during Budget Estimates last week.

This includes confirmation that the contractor responsible is no longer working for the NSW Reconstruction Authority, and that an independent review into the incident will be made public.

The breach dates back to March 2025, when a contractor accessed and downloaded a large file from the Resilient Homes Program system. That file was then uploaded to a personal ChatGPT account, in breach of NSW Government IT policies.

Reconstruction Authority Executive Director Kristie Clarke outlined what occurred.

“As you indicated, a contractor downloaded quite a large file from one of our Resilient Homes Program Salesforce systems. This was in breach of the New South Wales government IT policies. That file was downloaded from Salesforce and then uploaded to a personal ChatGPT account. It was quite a large file, containing over 10,000 individual records.”

The file was detected through internal IT monitoring systems. However, determining exactly what had been uploaded, and whose information had been affected, proved complex.

Ms Clarke told the hearing retrieving the correct file took time.

“Unfortunately, the contractor did not provide the correct files in the first instance, so we had to make a number of requests to get those files.”

Because the upload occurred via a personal account, forensic specialists were engaged to analyse the data and determine the scope of the breach. While more than 10,000 records were contained in the file, the detailed review found that 2,031 individuals had personal information impacted.

Lismore MP Janelle Saffin, who is also the Minister responsible for the Reconstruction Authority said she was formally notified months after the incident occurred.

“It was around July when I was formally notified, 7 July, actually.”

When questioned about the time taken between the March breach and October notification of affected residents, the Minister acknowledged the delay.

“I was advised that it took that long to work out which files had been in the so-called public domain, and it took that time. For me, it wasn't satisfactory that it took that long, but it did.”

She also confirmed it was not 10,000 individuals impacted.

“It wasn't the 10,000. That's what they had to sort through. It was 2,031 individuals, and everyone was contacted.”

Following notification of the breach, the Minister directed that an independent review be undertaken.

“That independent review has taken place and it's nearly finalised. I'm just getting the affirmation from Ms Fitzgerald that that is nearly finalised. I said the findings of that would be made public, so you'll see that in due course.”

The review is now nearing completion and will be released publicly.

For the Northern Rivers community, the breach struck at a sensitive time. Thousands of flood-affected homeowners had provided personal and, in some cases, sensitive information as part of applications for buybacks, retrofits and relocations under the Resilient Homes Program.

The public release of the independent review will provide the most detailed account yet of how the breach occurred, how it was handled, and what changes have been implemented since.