Search results

Information about the PageUp Data Breach

The Harvey Norman Australia Careers site is among a number of other Australian websites which may have been impacted by a data security breach at its third party service provider, PageUp.

PageUp has confirmed that an unauthorised person/s gained access to PageUp systems and some personal data relating to job applicants and references may have been accessed by the unauthorised person/s and possibly disclosed.

What information may have been accessed?

PageUp is not yet in a position to confirm if any specific category of user data has been compromised as a result of the data security incident.

PageUp’s forensic experts have identified that compromised data may include names, street addresses, email addresses, and telephone numbers.

Depending on what information was entered into the PageUp system when applying for a position, the following data may also have been compromised:
• Visa type (Sub Class) and Visa expiry date;
• “Yes” or “No” to a question regarding any medical condition or physical impairment that prevents the performance of the inherent requirements of the role, for example bending, lifting (including any notes that may have been added to this question);
• “Yes” or “No” to the criminal history question (including any notes that may have been added to this question);
• Identification as Aboriginal/Torres Strait Islander;
• Gender;
• Age bracket (selected via drop down options);
• “Yes” or “No” to the question of refugee status; and
• Referee names and contact details.

PageUp has advised that the following information is not affected: employment contracts, applicant resumes, tax file numbers, financial information such as credit card or bank account details (except as indicated above), and information contained on onboarding, performance, learning, compensation or succession modules.

What are we doing?

As we take your privacy and data security very seriously, we have written to the Office of the Australian Privacy Information Commissioner (OAIC) and we are directly notifying potentially affected individuals. We temporarily suspended our PageUp job application website until PageUp provided us with assurances that the system was safe to use.

We have met with PageUp and are receiving ongoing updates in relation to their forensic investigations. PageUp have lodged a mandatory data breach notification with the OAIC with respect to the breach on behalf of all companies affected.

We have joined the Joint Cyber Security Centre (JCSC) and representatives from our company have attended JCSC briefings with respect to the PageUp breach and will continue to do so until PageUp’s forensic investigations have concluded.

What should I do?

PageUp have recommended that you change your password and change your passwords on other online services, if you re-use the same password.

PageUp have also recommended that you:
• enable multi-factor authentication and other available security measures provided by your other online services;
• be aware of potential phishing emails and telephone calls from businesses or institutions requesting your personal details;
• avoid opening attachments from unknown senders via email or social media;
• install anti-virus software and keep it updated; and
• apply all recommended software patches from operating system and software providers.

The Office of the Australian Information Commissioner has released some additional guidelines: https://www.oaic.gov.au/individuals/data-breach-guidance/what-to-do-after-a-data-breach-notification#protecting-yourself-from-identity-fraud.

Where can I get more information?

For general information about how you can you protect your data privacy, visit the Australian Competition and Consumer Commission website at www.scamwatch.gov.au.

For further information on how to protect your identity and respond to identity concerns, please visit the OAIC’s data breach guidance note for individuals at: https://www.oaic.gov.au/individuals/data-breach-guidance or ID Care’s Learning Centre at https://www.idcare.org/learning-centre.

For further information on the data breach, please see the PageUp Data breach site: https://www.pageuppeople.com/unauthorised-activity-on-it-system/

If you have any general enquiries, please contact the Privacy Officer at hnprivacy.officer@au.harveynorman.com.

Current opportunities