Sensitive information about 31 of the world’s top leaders was revealed to the organizers of an Aussi soccer tournament last November, in a major gaffe caused by an e-mail autofill error.
A staff member at Australia’s Department of Immigration inadvertently caused the breach of personal information belonging to the world leaders attending the G20 Leaders’ Summit in Australia last year.
Australia hosted the G20 Leaders’ Summit last November with U.S. President Barack Obama, U.K. Prime Minister David Cameron, Russian President Vladimir Putin, German Chancellor Angela Merkel, Japanese Prime Minister Shinzo Abe and Chinese President Xi Jinping attending, to name a few.
The breach is only now coming to light thanks to e-mails obtained under freedom of information by The Guardian.
The Department of Immigration staff member apparently sent the personal information — such as passport numbers, dates of birth and visa numbers — of all the leaders to the Local Organizing Committee of the Asian Cup international soccer tournament.
The e-mail obtained by The Guardian revealed Australia’s Privacy Commissioner was advised of the breach on Nov. 7. The Department of also requested “urgent advice… given the sensitivities involved.”
According to the documents seen by The Guardian: “The cause of the breach was human error. [Redacted] failed to check that the autofill function in Microsoft Outlook had entered the correct person’s details into the e-mail ‘To’ field. This led to the e-mail being sent to the wrong person,” the e-mail from the Department’s Director of Visa Services reads.
“The personal information which has been breached is the name, date of birth, title, position, nationality, passport number, visa grant number and visa subclass held relating to 31 international leaders (ie, Prime Ministers, Presidents and their equivalents) attending the G20 Leaders’ Summit.”
The report indicated the person who received the e-mail immediately informed the staff member he had “sent the e-mail to the wrong person.” The recipient also verified it had been deleted and had not been forwarded or copied to a backup system.