Nine Entertainment is conducting an audit of its external data security practices after a breach exposed the personal information of approximately 16,000 subscribers to its major mastheads, The Sydney Morning Herald, The Age, and The Australian Financial Review.
The breach, first reported by Crikey, was discovered by a cybersecurity researcher using the pseudonym “bucketchallenge” on Mastodon.
The researcher found an improperly secured Amazon Web Services (AWS) S3 storage bucket containing subscriber names, postal addresses, and email addresses.
However, Nine confirmed that credit card details and passwords were not compromised.
A Nine spokesperson stated that the breach was caused by an “unauthorised change” by a third-party supplier and emphasised that Nine’s internal technology infrastructure remained secure.
The company moved swiftly to address the issue and is directly notifying affected subscribers.
This incident highlights growing cybersecurity risks, as seen earlier this week when the NSW Department of Communities and Justice reported a separate breach involving 9,000 sensitive court files.
With Nine holding the login details of 22 million users across its media platforms, including the Nine Network and Stan, the company’s data security measures are now under heightened scrutiny.
