Wunan Foundation cyber-incident

17 MAY 2023

As previously announced in late March 2023, Wunan Foundation experienced a cyber-security incident where an unidentified third-party may have gained unauthorised access to an area of the Wunan Foundation IT environment.

Upon discovery of the incident, we engaged leading external cyber-security and forensic IT experts to support us in securing our IT environment and to investigate what may have occurred.

This investigation is now complete and identified the unauthorised third-party may have gained access to some business / commercial information held in our IT environment. Following our investigation, we do not believe that any personal information has been or will be misused. 

We will keep this under review for 3 months, including implementing dark web monitoring, and take any appropriate actions as required if this position changes. 

Wunan Foundation takes cyber security very seriously and has applied enhanced cyber-security measures to prevent any recurrence. We have also notified the Australian Cyber Security Centre (ACSC) and the Office of Information Commissioner (OAIC) of the incident.

For clarity, Wunan Health and Wellbeing Centre is a separate entity to Wunan Foundation and is not involved in this cyber-security incident.

Should any stakeholders have questions or concerns in relation to this matter, they can contact us via communications@wunan.org.au and we will respond as soon as possible.

30 MARCH 2023

Wunan Foundation today advised that it had recently experienced a cyber-security incident where an unidentified third party may have gained unauthorised access to an area of the Wunan Foundation IT environment.

For clarity, Wunan Health and Wellbeing Centre is a separate entity to Wunan Foundation and is not involved in this cyber-security incident.

Wunan Foundation is also aware that it has been mentioned on the dark-web (a hidden part of the internet not easily-accessible by the general public) by a third-party claiming to have downloaded some information from Wunan Foundation.

As an Indigenous not-for-profit organisation that serves many remote communities across the East Kimberley region, we are deeply saddened that anyone would target our organisation in this way. As such, we will not be engaging or negotiating with the unidentified third-party who has claimed responsibility for the unauthorised-access.

We have engaged leading external cyber-security and forensic IT experts to support us in securing our IT environment. These experts are also conducting an investigation into what may have occurred, and if any information stored within our IT environment may have been downloaded, which currently remains unverified.

We have also notified the Australian Cyber Security Centre (ACSC) of the incident.

We have no credible evidence at this stage of our investigation that any information has been downloaded from our IT environment, or that personal information has been involved in this incident. Should our investigation indicate otherwise at a future point, we will notify any at-risk individuals as soon as practicable, consistent with our regulatory obligations.

Should any stakeholders have questions or concerns in relation to this matter, they can contact us via communications@wunan.org.au and we will respond as soon as possible.

We thank the community and our partners for their support in relation to this incident and will provide further updates on this website as our investigation progresses.