Australian Court Data Offshored to India in Repeated Security Breaches
Newly uncovered emails reveal that sensitive Australian court data was accessed in India over a decade ago, with no action taken by authorities despite warnings. Former Auscript national manager Paul Cutbush raised concerns with the Federal Circuit and Family Court and the Australian Federal Police (AFP) in December 2014, but the court dismissed the breach as "technical, minor, and inconsequential."
Auscript, then responsible for court transcription services, had offshored data without notifying the court. In 2016, the family court acknowledged that Auscript had conducted a seven-month pilot in India, despite contractual prohibitions on transferring data overseas without approval. Auscript claimed the operation was encrypted and temporary, but Cutbush alleged it lasted longer and involved at least 10 staff and equipment sent to India.
Years later, VIQ Solutions Auscript’s successor repeated the breach, allowing highly sensitive court files to be accessed in India. The incident prompted calls for a forensic audit and raised national security concerns, leading to VIQ’s liquidation in 2024.
Current court leadership claims they were unaware of the earlier offshoring until questioned by the ABC. A spokesperson stated that offshore access to court data is now strictly prohibited. However, opposition figures, including Shadow Attorney-General Michaelia Cash and Senator David Shoebridge, have demanded a full investigation into the breaches and their potential national security implications.
The Federal Circuit and Family Court has lodged a formal complaint with Canada’s privacy commissioner, where VIQ’s parent company is based. The attorney-general’s department maintains that the courts are responsible for their own operations.
VIQ Solutions TPRM report: https://www.rankiteo.com/company/viq-solutions
Auscript TPRM report: https://www.rankiteo.com/company/auscript
"id": "ausviq1792089194",
"linkid": "auscript, viq-solutions",
"type": "Breach",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Unknown number of court case '
'participants',
'industry': 'Legal/Judicial',
'location': 'Australia',
'name': 'Federal Circuit and Family Court of Australia',
'size': 'Large',
'type': 'Government Judicial Body'}],
'attack_vector': 'Unauthorized Data Transfer',
'data_breach': {'data_encryption': 'Claimed by Auscript (unverified)',
'data_exfiltration': 'Yes (accessed in India)',
'file_types_exposed': 'Transcription files, legal documents',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information, legal proceedings)',
'type_of_data_compromised': 'Court transcripts, family court '
'records, sensitive legal '
'documents'},
'date_detected': '2014-12',
'date_publicly_disclosed': '2024',
'description': 'Sensitive Australian court data was accessed in India over a '
'decade ago without authorization. Despite warnings from a '
'former Auscript manager, authorities took no action. Auscript '
'and its successor, VIQ Solutions, offshored data in violation '
'of contractual agreements, leading to national security '
"concerns and VIQ's liquidation in 2024.",
'impact': {'brand_reputation_impact': 'Severe reputational damage to Federal '
'Circuit and Family Court',
'data_compromised': 'Sensitive court data, including family court '
'records',
'identity_theft_risk': 'High (sensitive personal and legal data '
'exposed)',
'legal_liabilities': 'Potential regulatory fines, legal actions',
'operational_impact': 'Potential national security risks, loss of '
'trust in court systems',
'systems_affected': 'Court transcription services'},
'investigation_status': 'Ongoing (demands for full investigation by '
'opposition figures)',
'lessons_learned': 'Need for stricter oversight of third-party vendors, '
'enforcement of data sovereignty policies, and timely '
'incident response.',
'motivation': 'Operational cost reduction, unauthorized data access',
'post_incident_analysis': {'corrective_actions': 'Prohibition of offshore '
'data access, formal '
'complaints to regulatory '
'bodies, potential policy '
'reforms.',
'root_causes': 'Contractual non-compliance, lack '
'of oversight, repeated offshoring '
'by vendors, delayed response by '
'authorities.'},
'recommendations': 'Forensic audit of breaches, stricter contractual '
'penalties for non-compliance, enhanced monitoring of data '
'access, and transparency in judicial operations.',
'references': [{'date_accessed': '2024', 'source': 'ABC News'}],
'regulatory_compliance': {'legal_actions': 'Formal complaint to Canada’s '
'privacy commissioner',
'regulations_violated': 'Contractual data handling '
'agreements, potential '
'privacy laws'},
'response': {'communication_strategy': 'Public disclosure via ABC (2024)',
'containment_measures': 'Offshore access now strictly prohibited '
'(post-2024)',
'incident_response_plan_activated': 'No (dismissed as minor in '
'2014)',
'law_enforcement_notified': 'Yes (AFP notified in 2014, no '
'action taken)',
'remediation_measures': 'Formal complaint lodged with Canada’s '
'privacy commissioner'},
'stakeholder_advisories': 'Court leadership claims unawareness until 2024; '
'opposition demands investigation.',
'threat_actor': 'Auscript, VIQ Solutions',
'title': 'Australian Court Data Offshored to India in Repeated Security '
'Breaches',
'type': 'Data Breach',
'vulnerability_exploited': 'Contractual non-compliance, lack of oversight'}