Coober Pedy council says the disclosure was caused by a software issue—but has not revealed how many accounts were affected or whether the community faces any continuing risk.

The District Council of Coober Pedy has confirmed that a software problem caused one customer’s complete account statement to be sent to an unrelated local business.

The disclosure was discovered when a local Caravan Park received a two-page statement from council on 9 September. One page belonged to the caravan park. The other contained account and payment information belonging to an entirely separate organisation.

The Bush Telegraph has sighted the original document but will not identify the affected organisation or publish its account details.

The incorrectly disclosed statement contained the organisation’s name and postal address, council debtor number, BPAY reference, invoice information, the nature and age of the charge, and the total council claimed was payable.

The caravan park owner notified council of the disclosure on 10 September and submitted a series of questions about how it occurred, whether other accounts were affected, whether the affected party had been notified and what council intended to do to prevent it happening again.

Council initially acknowledged the complaint and said it would investigate the matter under its Customer Complaint Handling Policy.

Eight days later, council provided an update confirming that the disclosure was not simply the result of somebody attaching the wrong document to an email.

“We have identified that the disclosure occurred as a result of a software issue during the generation of account statements,” council wrote.

Council said the issue “appears to be limited”, that it had contacted the relevant parties and that it was taking “appropriate steps” to address the matter.

However, its response did not explain what “limited” means.

Council has not said how many statements were generated while the software problem existed, how many customers were affected, whether the problem involved a single document or an entire statement batch, or whether a complete audit has been conducted.

It has also not said when the software fault began, whether it has now been repaired, what testing has been undertaken or whether other account statements may previously have been sent to incorrect recipients without anybody noticing.

Those are not insignificant details.

Council’s billing system potentially contains names, addresses, email addresses, debtor numbers, payment references, transaction histories and details of amounts allegedly owed. Depending on the type of account, those records may relate to residents, ratepayers, contractors, local businesses or other organisations dealing with council.

The confirmed incident therefore raises a much broader question: was this the only disclosure, or merely the first one brought to council’s attention?

No public warning located

At the time of writing, The Bush Telegraph has not located a public notice from council advising residents or businesses of the statement-generation problem.

Council says it has contacted “the relevant parties”, but it has not explained how it determined who those parties were or whether every statement produced during the affected billing run has been examined.

Without a public notice, other customers may not know there has been a problem or that they should check whether documents sent to them contain somebody else’s information.

It is also possible that a recipient could overlook an incorrect page, delete the email or assume that council already knew about the mistake.

A wider notice would allow residents and businesses to check their correspondence and report any similar incidents. It would also give the community some assurance that the problem has been identified, contained and corrected.

Instead, council has so far dealt with the matter privately through its customer complaint process.

Questions still unanswered

Council was asked whether:

• the incident had been formally recorded as an information-security or confidentiality incident;
• the affected organisation had been notified;
• other customers received statements belonging to third parties;
• the complete statement distribution run would be audited;
• safeguards existed to prevent accounts from being combined incorrectly;
• those safeguards failed;
• corrective measures had been implemented; and
• council’s debtor and account records remained reliable following the software failure.

Council has confirmed that relevant parties were contacted, but has not yet answered most of those questions.

It declined to discuss the other organisation’s account, stating:

“Council is unable to comment on the accounts, transactions or interactions of other entities and will only discuss matters relating to your own account.”

That refusal is understandable insofar as nobody is asking council to publicly discuss another customer’s financial affairs. In fact, protecting that information is precisely the point.

Council can explain the scale of the software failure, its data-security implications and the measures taken to protect customers without identifying or discussing any individual account.

The public-interest question is not whether council should reveal another customer’s business. It is how council came to reveal that business in the first place—and whether it has happened to anyone else.

Council’s full response still pending

Council advised on 10 September that it would endeavour to provide a response within 10 business days and would keep the complainant informed if additional time was required.

Its 18 September email described itself as an update and said council would “continue to collate” its response to all the matters raised.

Accordingly, council still has time remaining within its nominated response period, and the software explanation should not necessarily be treated as its final answer.

The Bush Telegraph will publish council’s substantive response when it is received.

Nevertheless, the admission already made is important enough for the community to know: council has confirmed that faulty software caused one customer’s account statement to be disclosed to another.

What remains unknown is how long the problem existed, how many documents it affected, whether every affected recipient has been identified and whether the fault has been conclusively fixed.

Check your council correspondence

Residents and businesses who have recently received account statements from council should check every page carefully.

Anyone who has received information belonging to another person or business should notify council in writing and retain the original correspondence as evidence. They should not publish or circulate the document, particularly if it contains debtor numbers, payment references, addresses or other identifying information.

Anyone who believes their own information may have been disclosed should ask council whether their account was included in the affected statement run and what steps have been taken to protect their information.

The Bush Telegraph would also like to hear from anyone who has experienced a similar incident. Readers can report that an error occurred without initially forwarding or revealing the confidential information involved.

Council may ultimately establish that this was a single, contained failure. If so, it should be able to say that clearly and explain how it reached that conclusion.

Until then, “the issue appears to be limited” is an assurance—not an answer.