Security Update

Once we detected the incident, we took steps to secure our system and investigated what has happened. Our investigation has determined that some personal information belonging to some staff and clients may have been impacted. We are notifying all affected individuals and providing them with further specific detail about their personal information impacted, support options, and recommended steps that they can take.

Unfortunately, our ongoing investigation has determined that personal information has been impacted. We have conducted a comprehensive review of the information and have provided tailored notifications to each affected individual, detailing their specific information impacted and the relevant recommended steps to take in response. As you can appreciate, this was a complex process and it took some time.

If your information has been impacted, you will receive a formal notification from Meli that is tailored to you. This notification will contain further specific detail about the nature of the information that has been impacted, support options available, and recommended steps you can take in response.

We appreciate that this incident may cause concern and we are here to support you. We are notifying all affected individuals and providing them with tailored support options and recommended steps that they can take in response.

We have also informed the Australian Cyber Security Centre, Victoria Police, Office of the Australian Information Commissioner, Office of the Victorian Commissioner and relevant government agencies about the incident. We will continue to cooperate with law enforcement and the relevant government agencies as required, which includes to monitor for suspicious activity and implement additional security measures where appropriate.

In addition to progressing our investigations, Meli has been granted a court-ordered injunction to prevent any access, dissemination or publication of the impacted data by any third party. We have asked that interested parties do not attempt to access any impacted data, as this is a criminal offence in contravention of the court order.

Obtaining the injunction is part of our ongoing commitment to our valued partners and Meli community. This includes taking all reasonable steps in response to this incident to protect the impacted data and those most vulnerable.

We have also set up a dedicated team to support all impacted individuals. This includes a manager and three practitioners to oversee the notification process.  If you have any questions or need assistance, please contact Meli on cyber@meli.org.au or call our Cyber Incident Enquiry Line on 03 5292 8731 from 9am-5pm weekdays.

We are working as quickly as we can to notify all affected individuals. We are and will provide a tailored notification to you based on your personal information impacted, relevant support available and recommended steps to take in response.

As you can appreciate, this was a complex process, and it took some time. We thank you for your patience and we encourage you to visit this web page for ongoing updates.

We recommend that all impacted individuals refer to the guidance in their notification letter. More broadly, we kindly ask you to remain vigilant and monitor for any suspicious activity, particularly any unusual communications by phone or email requesting information, payments or proof of your identity.

Further information about online safety, cyber security and other helpful tips can be found at the Australian Cyber Security Centre website www.cyber.gov.au or the ACCC’s Scamwatch website www.scamwatch.gov.au.

If you require further information or need assistance, please feel free to contact Meli on cyber@meli.org.au or call our Cyber Incident Enquiry Line on 03 5292 8731 from 9am-5pm weekdays.

We are aware of a claim that a subset of information has been taken from our system and published externally by an unauthorised third party. Meli has been granted a court-ordered injunction to prevent any access, dissemination or publication of the impacted data by any third party. We have asked that interested parties do not attempt to access any impacted data, as this is a criminal offence in contravention of the court order.

We have taken a prudent and cautious approach to assessing this matter and are notifying affected individuals of the incident, as well as the Australian Cyber Security Centre, Office of the Australian Information Commissioner, Office of the Victorian Information Commissioner and relevant government agencies. We are disappointed that this incident has occurred and apologise for any distress or inconvenience this incident has caused.