HUNTER patrons could be among more than a million visitors to pubs, clubs and restaurants across the state who may be at risk of identity theft after a potential data breach.
It's understood signatures, addresses, birth dates, phone numbers and possibly driver's licence photographs may have been shared by Australian-based tech company Outabox with an overseas developer while creating gaming and hospitality products.
Among the venues listed on website 'haveibeenoutaboxed.com' are several Hunter and Central Coast clubs.
Outabox has released a statement, confirming it is aware of a potential data breach by an unauthorised third party from a sign in system used by its clients.
"We are working as a priority to determine the facts around this incident, have notified the relevant authorities and are investigating in cooperation with law enforcement," it said.
"We are restricted by how much information we are able to provide at this stage, given it is currently under active police investigation.
"We understand this news may cause concern to our staff, clients and their customers, and we thank them for their support and patience as we work to resolve this as swiftly as possible."
Outabox said it will provide further details as soon as it is able to.
Hunter and Central Coast clubs understood to be involved include Bulahdelah Bowling Club, Central Coast Leagues Club in Gosford, Mex Club in Mayfield, East Cessnock Bowling Club, Gwandalan Bowling Club, Halekulani Bowling Club in Budgewoi.
East Maitland Bowling Club was wrongly caught up in the data breach, which is believed to have released the records of more than one million people online.
Club president Bill Hopkins was quick to allay the fears of the club's 19,000 members, who may have been worried that their personal details had been compromised.
"We are not part of this breach, we were incorrectly added to the list of clubs that were hit," he said.
"We found out yesterday there had been a breach made and our CEO was quickly on the job checking with ClubsNSW and the company involved.
"We have learned we were incorrectly added to the list, why that happened we don't know but we are not affected."
He said the club has been inundated with calls from concerned members.
"We're trying to get the information out there that we have not been caught up in this breach and we have taken special steps to ensure this does not happen," Mr Hopkins said.
"It's important we get the message out there that everything is okay."
Outabox is used by venues such as RSLs and clubs for digital sign-in services, but East Maitland Bowling Club does not use this IT provider.
It's claimed the data involved includes facial recognition biometrics, scans of driver licences, signatures, club membership data, addresses, birthdays and details about visits to venues such as slot machine usage.
In NSW registered clubs are required by law to collect personal information from patrons entering the venue.
Bulahdelah Bowling Club is one of the venues named in the breach and said it had previously used Outabox for its electronic sign-in system but hadn't been associated with the company for "several months".
"We are hoping that the impact on our club will be minimal or zero, given that we no longer deal with Outabox," it said in a statement on Facebook.
"However, if we discover that the data breach has had any effect on our club or our members, we will advise further."
NSW Police have confirmed officers from the State Crime Command's Cybercrime Squad are investigating a potential data breach.
"As the investigation is ongoing, no further information is available at this time," a spokeswoman said.
ClubsNSW has been contacted for comment.
