Case Study: The NSW Reconstruction Authority Leak

The cleanest Australian, public-sector, contractor-driven example of how this goes wrong.

Case study~15 min

The big idea

This is the lead case study of the course because it's Australian, recent, public-sector and contractor-driven. Between 12–15 March 2025, a former temporary contractor at the NSW Reconstruction Authority uploaded a spreadsheet — 10 columns by more than 12,000 rows of personal and health data from the Northern Rivers Resilient Homes Program — into ChatGPT. The Authority later confirmed 2,031 people had personal information involved. It was disclosed publicly on 6 October 2025 — more than six months after the upload.

Key insight: One contractor, one spreadsheet, one paste — and 2,031 people's data was exposed, undetected for six months. This is exactly the risk profile of a Defence-industry contractor.

What you'll see

The March 2025 timeline and the controls now in place.

What happened, and what would have stopped it

The timeline and the lessons. Tap to expand.

Key points to remember

A contractor pasted 12,000+ rows of personal data into ChatGPT.

2,031 people were confirmed affected; undetected for ~6 months.

The fix combined policy, staff guidance and technical upload-blocking controls.

This is the closest analogue to the Defence-industry contractor risk.

Prev: What Shadow AI Is Next: Samsung & Detection