Public notification for spatial server data breach

On the 29 June 2026 there was unauthorised third-party access to the EPA spatial server, containing information relating to individuals associated with Contaminated Land Management (CLM) and Underground Petroleum Storage Systems (UPSS) site attributes.

As soon as we became aware of the incident on 13 July 2026, we took immediate steps to secure the information and investigate the matter. This included revoking unauthorised access and strengthening access controls by updating relevant permissions and user privileges.

The investigation found that a subfolder containing CLM and UPSS spatial datasets had inadvertently been assigned public access permissions. This resulted in the unauthorised access to and disclosure of personal information. The affected folder may have been publicly accessible from approximately April 2021 until 13 July 2026, when access was removed.

The personal information involved may have included full names and contact addresses. 

Importantly the EPA can confirm that no financial or primary proof-of-identity documents were exposed.

We have notified the NSW Information and Privacy Commissioner and are making all attempts to contact potentially impacted parties.

While the risk of harm resulting from this breach is considered low, affected individuals should remain alert to any unexpected communications that reference their personal details.

Individuals should

• Be cautious of unexpected emails, phone calls or text messages seeking personal information
• Avoid opening links or attachments from unknown or unexpected senders 
• Use strong and unique passwords for online services
• Enable multi-factor authentication where available
• Monitor for signs of identity misuse, scams or fraudulent activity
• Contact ID Support NSW for assistance