Data breach response
Find everyone a breach touched
Donna’s agents read everything that was taken, find whose personal information was exposed and build the notification list. Every entry cites its page.
Book a demoClaims mailbox and file share, October 2026
Donna prepares; a person does it.
Overview
The notification list holds 48,213 people. Found 31,077 dates of birth, 12,940 Medicare numbers, 4,118 driver licence numbers, 2,306 bank account numbers and 611 health records.
6,412 files in scope · 9,880 pages · 99,265 findings · 48,213 people
Next: Decide 2 conflicts between records.
Clock
Became aware 9 October 2026, 08:40 amIT incident log, Southgate.pdf, page 2
ChangeAPRA notification (CPS 234): by 12 October 2026, 08:40 amRecorded as sent.
OAIC assessment (s 26WH): by 8 November 202621 days left.
- Record sent: Statement to the OAIC
Statement to the OAIC and notices to people (s 26WK, s 26WL): as soon as practicable after the assessmentStarts when the assessment ends.
Conflicts
Date of birth.Two records for Peter Langley give 14 March 1971 and 4 March 1971.
Donna: same person, because the policy number and the home address match.
Policy schedule, P Langley.pdf, page 1Claim form 88213.pdf, page 3Same personDifferent people
QC
14 of 60 coded
Medicare number
2953 ••••• 1
Claim form 88213.pdf, page 3J and K move between items.
Claims mailbox and file share, October 2026
Donna prepares; a person does it.
Overview
The notification list holds 48,213 people. Found 31,077 dates of birth, 12,940 Medicare numbers, 4,118 driver licence numbers, 2,306 bank account numbers and 611 health records.
6,412 files in scope · 9,880 pages · 99,265 findings · 48,213 people
Next: Decide 2 conflicts between records.
Clock
Became aware 9 October 2026, 08:40 amIT incident log, Southgate.pdf, page 2
ChangeAPRA notification (CPS 234): by 12 October 2026, 08:40 amRecorded as sent.
OAIC assessment (s 26WH): by 8 November 202621 days left.
- Record sent: Statement to the OAIC
Statement to the OAIC and notices to people (s 26WK, s 26WL): as soon as practicable after the assessmentStarts when the assessment ends.
Conflicts
Date of birth.Two records for Peter Langley give 14 March 1971 and 4 March 1971.
Donna: same person, because the policy number and the home address match.
Policy schedule, P Langley.pdf, page 1Claim form 88213.pdf, page 3Same personDifferent people
QC
14 of 60 coded
Medicare number
2953 ••••• 1
Claim form 88213.pdf, page 3J and K move between items.
- Breach assessment
- Notification lists
- Statements and notices
- Redaction and release
It takes agents to investigate agents.
How Donna’s agents run the response
Processed
4,829,410 items
Claims mailboxes.pst412,880
Shared drive, Claims.zip1,204,311
Policy database.csv2,881,004- Broker iPhone.ufdr41,276
- SRV-FS02.E01289,939
Fingerprinted SHA-256Malware scannedDe-duplicatedText read, with OCR01
Take in everything that was taken
Mailboxes, file shares, database extracts, phones and disk images, as they arrive. Every file is fingerprinted on intake.
Personal information found
6,412 files in scope- Tax file numberCheck digit valid8,204Check digit valid
- Medicare numberCheck digit valid12,940Check digit valid
- Bank accountBSB checked2,306BSB checked
- Driver licenceFormat by state4,118Format by state
- Date of birth31,077
- Health record611
Set aside: 1,932 numbers shaped like a tax file number that fail the check digit.
02
Find the personal information
Agents read every file for tax file numbers, Medicare numbers, bank accounts and licences. Numbers that carry a check digit are tested, so lookalikes are set aside.
Conflicts
2 to decideDate of birth.Two records for Peter Langley give 14 March 1971 and 4 March 1971.
Donna: same person, because the policy number and the home address match.
Policy schedule, P Langley.pdf, page 1Claim form 88213.pdf, page 3Same personDifferent peopleAddress.Two records for Aisha Rahman give 12 Kent Street, Ryde and 12 Kent Street, Rydalmere.
Donna: same person, because the Medicare number and the date of birth match.
Member register.csv, row 18,204Change of address.msg, page 1Same personDifferent people
03
Resolve records to people
Donna joins records across sources into one person and says why. When two records disagree, a person decides.
QC
14 of 60 codedA random sample of 60 from 48,213 people, each checked against its page.
Medicare number
2953 ••••• 1
Claim form 88213.pdf, page 3CorrectReviewedPreviousNext04
Check a sample first
Before anyone is told, your reviewers check a random sample against the source page. The list’s accuracy is measured, not assumed.
Notification list
48,213 peoplePeter Langley · Date of birth, Medicare number
Claim form 88213.pdf, page 3
Aisha Rahman · Driver licence, bank account
Member register.csv, row 18,204
Wei Zhang · Tax file number, date of birth
Payroll June 2024.xlsx, row 412
Clock
Became aware 9 October 2026, 08:40 am IT incident log, Southgate.pdf, page 2
APRA notification (CPS 234): by 12 October 2026, 08:40 amRecorded as sent.
OAIC assessment (s 26WH): by 8 November 202621 days left.
Statement to the OAIC and notices to people (s 26WK, s 26WL)Starts when the assessment ends.
05
Build the list and keep the clock
One entry per person, with what was exposed and where. The OAIC’s 30 days to assess counts down beside it.
- BeforeAfter
SOUTHGATE MUTUAL LTD
ABN 62 093 481 527 · 120 Collins Street, Melbourne VIC 3000
Claims · September 2026
Page 1 of 3Claims paid by bank transfer
The following members were paid claims in September 2026. Their claim files were held in the claims mailbox and file share accessed on 9 October 2026.
Member TFN BSB / account Ashby, Thomas 482 117 903 063-114 10442290 Carver, Lucy 316 540 228 082-401 55120374 Doyle, Patrick 705 382 461 033-076 21987443 Hollis, Grace 229 814 656 062-000 17733051 Kerr, James 641 009 735 112-879 40065218 Claims on this page total $48,960.00. Each member is on the notification list for the October incident.
Prepared by Claims Operations, Southgate Mutual
SOUTHGATE MUTUAL LTD
ABN 62 093 481 527 · 120 Collins Street, Melbourne VIC 3000
Claims · September 2026
Page 1 of 3Claims paid by bank transfer
The following members were paid claims in September 2026. Their claim files were held in the claims mailbox and file share accessed on 9 October 2026.
Member TFN BSB / account Ashby, Thomas 482 117 903 063-114 10442290 Carver, Lucy 316 540 228 082-401 55120374 Doyle, Patrick 705 382 461 033-076 21987443 Hollis, Grace 229 814 656 062-000 17733051 Kerr, James 641 009 735 112-879 40065218 Claims on this page total $48,960.00. Each member is on the notification list for the October incident.
Prepared by Claims Operations, Southgate Mutual
17 boxes · 15 decidedPage 1 of 306
Draft, redact and release
Donna drafts the statement to the OAIC and the notices to people, every entry cited, and redacts the copies you release.
See your breach data become a cited notification list.
Book a demoBuilt to stand up to the regulator
Kept in Australia
Stored and processed in Australia, including AI processing and backups. Run it in Donna Cloud, a dedicated environment or your own cloud.
Every entry cites its page
Each person on the list links to the document and page their details came from. Every action by your team and the agents is logged.
Every file, not a sample
Agents read the whole set, from one mailbox to terabytes of company data, and the counts tie back to the files in scope.
Inside the 30 days
The OAIC asks for steps to run side by side, not one after another. Agents do, so the assessment never waits on a review queue.
No seat fees
Usage billed per matter, so a breach is priced as one matter, not by the reviewer hour.
For the whole response
Forensic firms running the response, the law firms advising and the breached organisation’s own team, in one matter. It takes your exports and produces load files.