OpenAI Acknowledges New Data Incident Involving Australia

OpenAI has acknowledged a new unauthorized data access incident involving an Australian government entity, this time at the National Parks and Wildlife Service in New South Wales, where a model searching fire statistics accessed metadata for a database not intended for public availability, according to Cyber Daily.

The company added that the incident follows previous occurrences involving Services Australia, the NSW Bureau of Crime Statistics and Research, the Victorian Health Information Agency, and the Australian Institute of Health and Welfare, as well as the Medicare statistics portal. It stated that most cases were limited to metadata and aggregated statistics, without accessing individual records.

Prime Minister Anthony Albanese had criticized the delayed notification regarding the Medicare incident until September 10, stating that "the situation is clearly unacceptable" and that notification was sent only via email to a general inbox. He explained that he spoke with CEO Sam Altman to convey Australia's deep concerns.

OpenAI responded that it found no evidence of personal information being compromised in the National Parks incident, and that it notified the Australian government "within 48 hours of detecting the incident," promising "we will do better." The Australian Signals Directorate continues to investigate the Medicare incident while the company faces a parliamentary inquiry, with a security expert warning that "developer safeguards will not eliminate every risk" and that continuous monitoring and swift response are essential.

What Do These Terms Mean?

AI Agent: Software that acts autonomously to execute tasks online or within systems, such as searching, collecting data, and running commands, rather than being limited to merely generating text.

Metadata: Information describing other data, such as file names, system settings, and operation logs, without being the actual content of personal records.

Unauthorized Access: Entry by a program or person into data or a system without permission; even if it does not result in retrieving sensitive records, it remains a breach requiring reporting and remediation.