Do Business with Lane Cove Council? Check Your Inbox After a Data Breach

If you do business with Lane Cove Council, check your inbox. Council has started emailing suppliers after a file containing their bank details was sent out by mistake.

On Monday 26 October an email to 500 of Council’s suppliers accidentally included an attachment containing accounts payable records. According to Council, the attachment included email addresses, business names, ABNs, account names, BSBs and account numbers.

Council began notifying affected suppliers on Tuesday 27 October. The email comes from [email protected] with the subject line “Data Breach Notification” and is signed by General Manager Louise Kerr.

What happened

Council says the incident was the result of human error and was not a cyber attack. It says its systems have not been compromised.

As soon as it became aware of the error, Council says it:

• contacted all recipients and asked them to delete the attachment immediately
• assessed what information was involved and who was affected
• started an internal investigation with its Information Technology and Governance teams
• notified the NSW Information and Privacy Commission
• began reviewing its processes to stop it happening again.

Council says it is contacting everyone whose information was involved directly. It has not detected any misuse of the information and will get in touch again if anything changes.

If you were one of the suppliers who received the attachment, Council has asked you to delete it.

Why it matters for small businesses

Plenty of Council’s suppliers are small local businesses and sole traders. For them a business name, email address and bank account lead straight back to a person.

Council’s own notification is clear about the risk.

That kind of scam has a name. Scamwatch calls it business email compromise or payment redirection. A scammer poses as a business you deal with and sends an invoice with new payment details, hoping you will pay them instead. Scammers can copy logos and ABNs to make it look real. A list of who supplies Council and how they get paid is exactly the sort of detail that makes a fake email look genuine.

What to do now

• Be wary of any email, text or phone call about invoices, payments or changes to bank details, even if it seems to come from Council. If in doubt, call Council on 02 9911 3555. Use that number, not one in the message.
• Never confirm or change payment details by replying to an email. Call the business on a number you have found yourself.
• Check email addresses carefully. Scammers often add a single letter or number so a fake address looks real.
• Think before you click a link or open an attachment.
• Keep an eye on your bank account and contact your bank straight away if anything looks wrong.
• If your business pays other suppliers, warn your accounts team. Treat any “we’ve changed banks” email with suspicion.

Where to get help

• Lane Cove Council: Acting Manager Governance & Risk Lorie Parkinson, [email protected] or 02 9911 3555. Council’s privacy information is at lanecove.nsw.gov.au/privacy.
• NSW Information and Privacy Commission: 1800 472 679 or [email protected]. Its fact sheet Notification to affected individuals of a data breach explains your rights, and its guide You have been told your information has been breached sets out practical next steps.
• ID Support NSW: a free NSW Government service that helps people protect and restore their identity after a data breach. Call 1800 001 040, weekdays 9am to 5pm, or use its online checklist.
• Scamwatch: report a scam or a suspicious invoice at scamwatch.gov.au.
• ReportCyber: businesses can report cyber crime through cyber.gov.au.

What the law says

NSW councils are covered by the state’s Mandatory Notification of Data Breach Scheme, which started in November 2023. Under the scheme, agencies including councils must notify affected people and the Privacy Commissioner when there has been an “eligible” data breach, one likely to cause serious harm. They have 30 days from becoming aware of a possible breach to assess whether it qualifies.

Council’s new data breach policy

In July Council put a draft Data Breach Response Policy on public exhibition. It sets out how Council will manage any breach involving personal information. The policy went back to Council in September for adoption. The six week exhibition attracted no submissions.

In the Cove has asked Council how many suppliers’ details were in the attachment, how many recipients have confirmed they deleted it, whether the incident has been assessed as an eligible data breach and whether it is the first handled under the new policy. We will update this article with Council’s response.

Did you get this email?

If you received Council’s notification or anything suspicious since, we would like to hear from you. Send us a WhatsApp message on 0470 490 417 (text only) or email [email protected].

Want a refresher on spotting scams? Read Immune to Scams? Think Again.