The Australian Human Rights Commission (AHRC) has suffered a data breach which could have affected hundreds of people who used its online complaint form.

The AHRC first became aware of an “unauthorised disclosure” of about 670 documents uploaded to the complaint form online on April 10.

This is believed to have happened between March 24 and April 10.

About 100 of those documents are believed to have been made publicly available and accessed on search engines like Google or Bing between April 3 and May 10.

Many of the documents contained personal information, including full names, email addresses, residential addresses, mobile numbers, employers and roles, work contact information, personal health information, schooling information, religion and photos.

Last week, the AHRC learnt that documents uploaded online for the AHRC’s Speaking from Experience project, Human Rights Awards 2023 nominations and the National Anti-Racism Framework concept paper had also been breached between April 3 and May 5. 

The AHRC is unable to confirm just how many people have been affected.

“The Commission acted to address the breach as soon as it came to our attention. We sincerely apologise for any distress or harm this data breach may have caused,” it said.

The AHRC said the disclosure was not the result of a malicious or criminal attack.

A taskforce has been established to investigate the breach and prevent any further access to the affected documents. 

All online forms have been disabled in the meantime, with complainants advised to fill out a PDF or Microsoft Word version of the form and return it to the AHRC by email or post.

“We have treated this data breach with the highest level of concern and are carrying out a thorough and comprehensive investigation and review of the impacted data, with the support of our experts,” the AHRC said.

”We have taken action to address the disclosure including having relevant documents removed from search engines.”

The AHRC believes the breach affected anyone who:

The AHRC will notify those who are affected.

Anyone who believes they have been affected can also contact the AHRC.