Bendigo Law Courts Hit by Data Breach, Thousands of Court Records Exposed
Bendigo Law Courts is responding to a data security incident after hacker 2019 leaked sensitive court records on a popular underground forum. The breach, disclosed on July 15, exposed over 28,600 lines of data related to cases heard at the consolidated court facility, including locations such as Bendigo, Castlemaine, Echuca, Kerang, Kyneton, Maryborough, Mildura, Ouyen, Robinvale, and Swan Hill.
A sample of the stolen data was posted as proof, with the full dataset made freely available on an anonymous hosting service. Court Services Victoria (CSV) confirmed the breach, stating that unauthorized access targeted information used to link participants to online hearings at the Magistrates’ Court of Victoria and the Children’s Court of Victoria between 2022 and 2026.
While the compromised system is separate from the Case Management System (CMS), the exposed data includes publicly available details such as case titles, hearing dates, and participant names as well as non-public information, including email addresses and roles (e.g., lawyers, court staff, observers).
CSV has taken immediate action, shutting down the access point, strengthening security, and notifying relevant authorities. The investigation remains ongoing, with updates to be posted on CSV’s Frequently Asked Questions page.
The hacker, 2019, has a history of targeting Australian organizations, including the Melbourne International Film Festival, a Canberra healthcare clinic, and the Australian Centre for the Moving Image. In 2019, they also breached the Australian Productivity Commission’s email systems, using access to harass journalists. Their motives and identity remain unknown.
Bendigo Law Courts serves the Bendigo and Loddon-Mallee region, hosting state and federal courts alongside legal aid services like Loddon Campaspe Community Legal Centre and Koori Services.
Court Services Victoria cybersecurity rating report: https://www.rankiteo.com/company/court-services-victoria
"id": "COU1785378287",
"linkid": "court-services-victoria",
"type": "Breach",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Participants in online hearings '
'(lawyers, court staff, '
'observers)',
'industry': 'Legal/Judicial',
'location': 'Bendigo, Victoria, Australia',
'name': 'Bendigo Law Courts',
'type': 'Government (Court Facility)'},
{'industry': 'Legal/Judicial',
'location': 'Victoria, Australia',
'name': 'Court Services Victoria (CSV)',
'type': 'Government Agency'},
{'industry': 'Legal/Judicial',
'location': 'Victoria, Australia',
'name': 'Magistrates’ Court of Victoria',
'type': 'Government (Court)'},
{'industry': 'Legal/Judicial',
'location': 'Victoria, Australia',
'name': 'Children’s Court of Victoria',
'type': 'Government (Court)'}],
'attack_vector': 'Unauthorized access',
'customer_advisories': 'Updates posted on CSV’s Frequently Asked Questions '
'page',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': 'Over 28,600 lines of data',
'personally_identifiable_information': 'Email addresses, '
'roles, participant '
'names',
'sensitivity_of_data': 'Mix of publicly available and '
'non-public information',
'type_of_data_compromised': ['Case titles',
'Hearing dates',
'Participant names',
'Email addresses',
'Roles (e.g., lawyers, court '
'staff, observers)']},
'date_publicly_disclosed': '2024-07-15',
'description': 'Bendigo Law Courts is responding to a data security incident '
'after hacker *2019* leaked sensitive court records on a '
'popular underground forum. The breach exposed over 28,600 '
'lines of data related to cases heard at the consolidated '
'court facility, including locations such as Bendigo, '
'Castlemaine, Echuca, Kerang, Kyneton, Maryborough, Mildura, '
'Ouyen, Robinvale, and Swan Hill.',
'impact': {'data_compromised': 'Over 28,600 lines of data',
'identity_theft_risk': 'Potential risk due to exposure of email '
'addresses and roles',
'operational_impact': 'Access point shut down, security '
'strengthened',
'systems_affected': 'System used to link participants to online '
'hearings'},
'investigation_status': 'Ongoing',
'references': [{'source': 'Court Services Victoria (CSV)',
'url': 'https://www.courts.vic.gov.au/'}],
'regulatory_compliance': {'regulatory_notifications': 'Yes'},
'response': {'communication_strategy': 'Notified relevant authorities, '
'updates posted on CSV’s Frequently '
'Asked Questions page',
'containment_measures': 'Shut down the access point, '
'strengthened security',
'incident_response_plan_activated': 'Yes'},
'threat_actor': '*2019*',
'title': 'Bendigo Law Courts Data Breach',
'type': 'Data Breach'}