Guardian Childcare breach exposed scanned ID documents of Australian families

Guardian Childcare and Education, a national provider with centres across New South Wales, Victoria, Queensland, the Australian Capital Territory and South Australia, told families in late May 2024 that an attacker had breached its systems and taken copies of identification documents held on file.

In emails sent to affected patrons, the company said a scanned image of the identification document supplied at the time of a visit or enrolment may have been compromised. Guardian said its investigation found that no other categories of personal information were taken, and that it had seen no evidence the documents had been misused.

Neither Guardian nor the outlets covering the disclosure put a firm number on the affected population. Insurance Business Australia reported that Guardian, which runs about 60 centres across Victoria, has thousands of customers. Cyber Daily, which described Guardian as the largest childcare provider in the state of Victoria, gave no count of affected families. Neither the attacker nor the method of intrusion was identified.

The company advised recipients to contact the authority that issued their identification document about obtaining a replacement, and to stay alert for scams or approaches referencing the breach. Guardian said it had reported the incident to the relevant authorities and had strengthened its security controls after completing its investigation.