Sydney Morning Herald, The Age and Financial Review readers exposed in data breach

Nine has had to warn thousands of readers of three of its major publications after their details were exposed in a data breach.

Some 16,000 subscribers of three major Nine mastheads have had their personal details exposed in a data breach. Picture: NCA NewsWire/Flavio Brancaleone

Nine has had no choice but to contact 16,000 subscribers from three of its major mastheads after their data was left exposed online.

Readers of The Sydney Morning Herald, The Age and The Financial Review were left unprotected by one of the publisher’s third-party suppliers that had access to subscriber details.

On Thursday, Nine confirmed that 16,000 subscribers had their names, postal addresses and email addresses exposed online.

No customers’ payment details or passwords were impacted by exposed data, a spokesman said. The breach was first reported by Crikey.

Nine has claimed its own infrastructure remains uncompromised and the data was exposed solely by the third party supplier.

“We have been made aware by a security researcher that certain personal information held by a third party supplier was not protected to the level of Nine’s strict internal data protocols after an unauthorised change. This included a limited number of The Sydney Morning Herald, The Age and Australian Financial Review print subscriber records,” the Nine spokesman said.

Nine had begun reaching out to impacted subscribers to warn them that their information had been exposed online. “While there has been no breach of Nine’s internal technology infrastructure, Nine treated this matter seriously and worked with the third party to resolve the issue,” he said.

“The customer personal information that was held by the provider was limited to name, postal address and/or email address. The data did not include credit card details or passwords. Nine is directly contacting all subscribers whose records were involved.”

Nine said that impacted subscribers would not be compensated. The publisher had advised its customer service team to provide additional support.

Third party suppliers continue to be a prime target for malicious actors and cyber criminals.

These external firms are often baited and exploited by cyber criminals to gain access to larger organisations or are used as an entry point to illegally obtain customer information for the purpose of scams or data brokerage.

On Thursday, the NSW government confirmed 9000 “sensitive court files” had been viewed by a hacker who had breached the Department of Communities and Justice.

NSW police have confirmed a breach took place inside an Online Registry that provides information related to criminal and civil cases in the NSW courts.

Originally published as Sydney Morning Herald, The Age and Financial Review readers exposed in data breach