PageUp security incident

03/07/2018

Downer and Spotless were among several organisations who may have been impacted by a data security incident associated with its recruitment technology provider, PageUp.

In response to this incident Downer suspended the use of the PageUp service.

Information on the incident can be found here: PageUp Security Incident Update (Update 1) and PageUp Security Incident Update (Update 2).

Downer has taken the following steps to investigate the incident and ensure the protection of personal information.

• PageUp were engaged to provide information on the security incident and a process was followed to remedy the incident.
• We confirmed that PageUp met its reporting obligations to the Office of the Australian Information Commissioner (OAIC).
• We initiated a reset of all candidate passwords in PageUp.
• We reset all passwords in our systems that connect to PageUp.
• We required that PageUp complete a complex security review of the PageUp platform issued by Downer.

The Office of the Australian Information Commissioner (OAIC), The Australian Cyber Security Centre (ACSC) and IDCARE have also issued a joint statement on the PageUp incident.

Resumption of PageUp services

Downer has received written assurances from PageUp and independent external security experts Klein & Co. indicating that:

• The original threat has been removed
• No further security issues have been identified on the PageUp system
• The PageUp system is safe to use
• Further security measures have been implemented to help guard against a similar incident in the future.

On this basis, Downer will recommence the use of the PageUp service from 3 July 2018.

Frequently Asked Questions (FAQ)

How do I know if my data has been affected?
We are not aware that any data on the Downer PageUp system has been impacted.  If you are concerned we recommend that you contact the Office of the Australian Information Commissioner’s (OAIC) for guidance.

Can I contact PageUp if I have any concerns?
Yes. You may contact PageUp on 1300 893 787 or 03 9068 7721.

Do I need to do anything to make my data safe?
No. PageUp’s system has been subject to rigorous review and this has indicated that their system is now safe to use. Independent security experts have confirmed this position. For safe measure, however, we recommend that you change your password regularly.

Is there any further information I can read on protecting my information?
Yes.  IDCARE is Australia’s national identity and cyber support service for the community.