Victoria Police is investigating the exposure of hundreds of victims of crime in a privacy breach by a tribunal established to assist them.
A staff member at Victoria's Victims of Crime Assistance Tribunal (VOCAT) sent a mass email on September 26 to people awaiting a hearing at the Tribunal.
But instead of making the mailing list BCC - blind carbon copy - the employee made it CC, meaning the personal emails of 486 recipients were revealed to everyone on the email chain.
A Melbourne offender then accessed the email chain to harass victims and distribute further private information and other sensitive materials.
'Triggering and alarming'
One victim of the breach told ACM many of the recipients didn't realise the error.
"So the original email went out about 2pm and everyone started replying all with more personal information about themselves because they didn't realise everybody else could see," she said.
"It was very triggering and alarming."
She said one of the recipients immediately called VOCAT to report what had happened.
"They stayed on the phone for a long time and in the end VOCAT just said no comment," the victim said.
Email chain hijacked
But the breach worsened when one of the recipients started a new email chain and introduced themselves as a Melbourne offender.
ACM cannot name the individual because of restrictions in the Victims of Crime Assistance Act, but the victim said she was "rattled" by this new series of breaches.
"This person emailing all of us was ranting... and sending [materials including] intervention orders and suppressed summons orders with none of the personal information blacked out," the victim said.
She said she and others targeted by the new email chain were "very, very distressed" by it.
"This person was harassing other people on the email chain, accusing some of them of making fake rape reports and things like that," she said.
"Then about 6 pm on Thursday night (September 26), VOCAT sent an email saying please delete all email chains, and that it had been sent in error. So they were trying to cover themselves up," she said.
A Court Services Victoria spokesperson confirmed the privacy breach.
"On Thursday afternoon, a number of email addresses of individuals who had previously contacted the Victims of Crime Assistance Tribunal (VOCAT) were unintentionally shared between the recipients after an email was sent in error," the spokesperson said.
"The email was a general update about changes to procedure and did not contain any sensitive information.
"The email was recalled, but some emails were opened. All those impacted have been contacted and VOCAT unreservedly apologises for the error."
Police investigation underway
The victim who spoke to ACM said she reported the incident to police as soon as she saw the unredacted intervention orders and summonses being emailed en masse.
"I knew that was pretty bad," the victim said.
She said police from the criminal investigation unit and cyber unit took copies of all the emails and said several other victims had also reported the incident.
"They said it's very serious," she said.
ACM asked Victoria Police whether the incident could spark criminal charges, but a spokesperson said they couldn't say at this stage.
"Victoria Police is aware of a distressing email which was sent to a number of people on Thursday, September 26," the spokesperson said.
"The matter is currently being investigated and as such it would be inappropriate to comment further at this time."
The victim said it was disappointing an organisation set up to support victims had caused such a traumatic privacy breach.
"It's really affected me, it's triggering and re-traumatising," she said.
The Court Services Victoria spokesperson said VOCAT was "looking at measures to ensure this does not happen again".
"VOCAT is mindful of the distress the unauthorised sharing of email addresses can cause and offers of support are being made to all involved," the spokesperson said.
"Any email recipients who may be feeling concerned have been encouraged to phone the Victims of Crime Helpline on 1800 819 817 for information, advice and support. Additional support arrangements are being finalised and further details will be provided to affected persons shortly."
