When we became aware of the issue in early September 2024, we immediately launched our incident response plan and proactively disabled some systems as a precaution and to remove any ongoing threat. 

As at 23 September, all of our systems have been restored to normal operational processes.

This is the subject of an ongoing investigation, and we are working closely with external cybersecurity experts, specialist legal counsel and regulatory authorities to understand the extent of the affected data.  

While this process will take some time to complete, we have progressed with our forensic analysis and have begun notifying some Compass Group Australia employees and former employees in instances where we know high-risk data has been accessed. 

We have begun contacting these individuals to tell them what information was involved, how we are supporting them, and the steps they can take to protect themselves against the risk of identity theft, scams or fraud.

We are currently in the process of formally notifying approximately 150 individuals or about 1% of our workforce about the cyber breach. The number of impacted individuals may increase in the coming weeks as our forensic investigation continues.

We sincerely apologise to our employees, clients and suppliers for any concerns this incident has caused.

A small number of Compass Group systems are managed across Australia and New Zealand. 

Our external forensic team is working hard to understand exactly what information has been compromised. Based on investigations to date, there is no evidence to suggest that data held by New Zealand systems has been impacted. 

As a precaution, we have notified the National Cyber Security Centre and engaged with the Office of the Privacy Commissioner in New Zealand.  We continue to work with these agencies as required. We will provide relevant updates as the investigation unfolds. 

Compass Group Australia has put in place a number of services to support individuals who have had high-risk personal information compromised.

The following measures will be available depending on a person’s individual circumstances:

• IDCARE: We have partnered with IDCARE, Australia and New Zealand’s national identity and cyber support community service. IDCARE’s expert case managers will work with impacted individuals to address any concerns about risks to their personal information, and any instances where they think information might be misused. IDCARE’s services are available at no cost to those affected by the cyber incident.
• Equifax: In Australia, we are providing free access for up to 1 year of cover under the Equifax Credit & Identity Protect subscription plan to monitor for any fraudulent activity.
• ID replacement: Where someone’s primary identity documents have been compromised, and the advice from the issuing government agency is to replace the document, Compass Group Australia will reimburse the cost of the replacement.

In addition to the above, we are recommending that individuals take the following general precautionary steps and remain vigilant to any misuse of their personal information:

• Remain alert to any increased scam activity, especially through email, text messages or telephone calls, particularly where the sender or caller purports to be from Compass Group.
• If you receive any suspicious emails, text messages or telephone calls, do not provide your online account passwords, or any personal or financial information.
• Do not respond to, open or click on links in emails/text messages if you are unsure about the sender.
• Visit the Australian Cyber Security Centre’s webpage at https://www.cyber.gov.au/protect-yourself/.
• Where available, use two-step authentication – such as an authentication application – for personal email accounts and other online accounts.
• Check your credit report (to alert you to any attempts to open a credit account in your name).
• Stay informed of the latest threats by visiting https://www.cyber.gov.au/threats and the latest scams by visiting https://www.scamwatch.gov.au/.
• visit IDCARE’s Learning Centre and the OAIC website for further information and resources on protecting your personal information.

Yes. We have reported the incident to the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC), who are providing assistance and support. We have also notified law enforcement. 

We have also notified the National Cyber Security Centre and engaged the Office of the Privacy Commissioner in New Zealand, as a precaution. We continue to work with these agencies as required and will provide relevant updates as the investigation unfolds. 

Where Compass Group Australia has collected personal information about our client’s employees, customers or residents and stored it on our systems, it is likely that this will constitute jointly held information.   

In these circumstances, the Privacy Act allows for one entity to notify the OAIC and affected individuals. Compliance by Compass Group Australia will be taken as compliance by any other entity which Compass Group jointly holds information. 

Here are some steps that everyone can take to protect themselves against identity theft, scams or fraud: 

• Remain alert to any increased scam activity, especially through email, text messages or telephone calls, particularly where the sender or caller purports to be from Compass Group.
• If you receive any suspicious emails, text messages or telephone calls, do not provide your online account passwords, or any personal or financial information.
• Do not respond to, open or click on links in emails/text messages if you are unsure about the sender.
• Visit the Australian Cyber Security Centre’s webpage at https://www.cyber.gov.au/protect-yourself/.
• Where available, use two-step authentication – such as an authentication application – for personal email accounts and other online accounts.
• Check your credit report (to alert you to any attempts to open a credit account in your name).
• Stay informed of the latest threats by visiting https://www.cyber.gov.au/threats and the latest scams by visiting https://www.scamwatch.gov.au/.
• Visit IDCARE’s Learning Centre and the OAIC website for further information and resources on protecting your personal information.

If our investigations identify that your high-risk information has been impacted by this incident, we will communicate directly with you to provide further information and offer guidance and advice on next steps. 

Any further enquiries or concerns can be directed to [email protected].