On Monday, 17 August 2026, we identified unauthorised access to a database system arising from a vulnerability through a third-party service provider. We immediately took steps to contain the incident and secure the affected systems.
The incident has been contained, and remediation work has been completed.
What we know
We have undertaken forensic analysis to establish what information was accessed and the extent of the incident. Our investigation so far has confirmed that the information involved relates to records from before June 2025 and primarily involves names, email addresses, and/or other contact details. A small number of data entries also involve Date of Birth.
We have contacted those we have identified as potentially affected to notify them and provide support, and we will continue to do so if our investigation identifies any further impact.
If you do not receive a notification from us, it is unlikely that your personal information has been affected.
What we have done
· Immediately contained the unauthorised access and secured the affected systems.
· Completed remediation work.
· Undertaken forensic analysis to establish what information was accessed.
· Confirmed that the information involved relates to records from before June 2025.
· Engaged external cyber security and privacy advisers.
The security of our guests’, staff and partners’ information remains our absolute priority. We are continuing to work with relevant privacy and cyber security authorities as our investigation progresses.
If you have any questions or concerns, please contact [email protected]
Contact details:
Media enquiries: LJ Loch at [email protected] or 0488 038 555 or Sari-Elle Kraemer on [email protected] or 0407284457
