TLDR
Internal emails show the ATO and ASIC suspected in March 2025 that transcription provider VIQ Solutions had sent government data offshore. ASIC called it a near miss and left VIQ to tell other agencies, a year before the court data breach became public.
KEY TAKEAWAYS
The tax office and the corporate regulator suspected in early 2025 that transcription provider VIQ Solutions had sent government data offshore, a year before the ABC revealed court data had been sent overseas by the same company.[1]
Emails between the Australian Taxation Office and the Australian Securities and Investments Commission, released under freedom of information, show ASIC did not alert the other agencies using VIQ. It left that to VIQ.[1]
Sensitive court and federal government data must not be stored or processed offshore because of hacking and national security risks.[1]
A link to the UK
The alarm was raised around March 2025, when VIQ sent the ATO an email with a link to a transcript "available for download" from a site in the United Kingdom.[1]
"This appears to indicate the [sic] VIQ Solutions is already allowing customer data to be shared, accessed or used outside of Australia. This is of serious concern to the Australian Taxation Office," an ATO assistant director wrote to ASIC and VIQ.[1]
Both agencies told staff to stop using VIQ while it investigated. Within days the ATO had doubts about VIQ's answers.[1]
"We have found some potential inconsistencies in VIQ response to date and more impacts the more questions we ask," an ATO director wrote.[1]
A 'near miss'
By early May, VIQ had given ASIC a report. Based on it, ASIC decided the incident was a "near miss" and that none of its own data had been compromised. No independent investigation looked at the other agencies using the service.[1]
ASIC managed VIQ's place on the government's preferred supplier panel. The emails show an ATO director asked whether other agencies might be affected, and an ASIC staff member said that would be discussed after ASIC's own investigation. The emails do not show whether that happened.[1]
ASIC said it had taken "appropriate action" and that "VIQ was responsible for notifying agencies affected under any separate arrangements". The ATO said it "reported the incident to the relevant panel manager".[1]
Thirteen agencies
At least 13 government agencies used VIQ before ASIC removed it as an approved supplier on March 19, 2026. VIQ went into administration after the court data breach became public and has since shut down.[1]
Administrators McGrath Nicol found in July that the company's directors may have breached their duties by "not acting with care and diligence".[1]
Shadow attorney-general Michaelia Cash said the government needed to investigate.
"It's astounding this issue continues to grow but the Attorney General keeps her head in the sand," Senator Cash said.[1]
SOURCES & CITATIONS
FREQUENTLY ASKED QUESTIONS
