Attack on United Australia Party and Trumpet of Patriots also breached the business entites of Clive Palmer
Take action: Do you want your companies to be descibed as having "breathtaking lack of care" for a cybersecurity incident? It seems if one is a rich enough, that's acceptable. Think of this before you give out your data to companies with huge budgets - will they care at all if they get breached?
Learn More
The breach that was originally reported to hit United Australia Party (UAP) and Trumpet of Patriots is now reported to compromise 11 business entities associated with the entrepreneur and politician Clive Palmer
The affected business entities include:
- Waratah Coal Pty Ltd,
- Central Queensland Coal,
- Gladstone Pacific Nickel Limited,
- Palmer Coolum Resort,
- Blue Star Line,
- Palmer Motorama,
- Ausface,
- Drewmaster Pty Ltd,
- Zeph Group entities.
- Mineralogy
- Queensland Nickel Group
The incident was identified as a ransomware cyber attack, with unauthorized access to servers detected on June 23, 2025. The compromised data includes all the content and attachment of emails to and from the affected entities:
- Email addresses and correspondence
- Phone numbers
- Identity records and documents
- Banking records and financial details
- Employment history information
- Confidential documents and arrangements
- Personal information provided to or created by the entities
The organizations acknowledge they "do not know comprehensively what information was on the server" but advise that anyone who provided information should assume it was stored on the compromised servers.
Reports suggest the breach could affect as many as 80,000 people, but this figure is disputed. The exact number of affected individuals has not been officially disclosed by Palmer's entities. The organizations stating they "do not keep a record of all individuals who were on the server" and have "determined it is impracticable to notify individuals" directly.
The breach was reported to the Office of the Australian Information Commissioner (OAIC) and the Australian Signals Directorate. The OAIC has stated that Palmer's parties have not actually reported their privacy breach to the office.
Cybersecurity experts have criticized the response to the incident, noting the "breathtaking lack of care" shown by effectively placing the burden of discovering compromised data on the victims themselves rather than conducting proper individual notifications.
