Westhaven — Credential compromise disclosed February 2026

New incident
Credential compromise
Verified from an official regulator or organisation notice

What this record states

Westhaven has reported a data breach through compromised account credentials.

The source states that information about participants was involved, across 7 categories of personal information.

No source consulted for this record states when the incident occurred.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: 17 February 2026
Notification date: Not confirmed
People affected: Not stated
Who was affected: participants

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

full name
date of birth
contact information
phone number
email address
address
medical information

Notifications and response

Regulators notified

Not stated

Law enforcement notified

NSW Police

Legal and formal response

engaged experts to assist with an investigation and provide advice

Technical and organisational remediation

Not stated

Official sources

Statement by the organisation

Data Breach Notification - Westhaven

westhaven.org.auRetrieved 15 August 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

Westhaven disclosed on 17 February 2026 that a participant accessed a staff member’s computer without permission and may have accessed or downloaded information relating to other participants. The information potentially affected varied, but generally included names, dates of birth, contact details and medical information. The record does not establish the incident date, discovery date, number of affected people, notification date, regulator involvement or technical remediation.

Westhaven states that it engaged experts to investigate and provide advice, and reported the matter to NSW Police, which seized devices and commenced an investigation. The available evidence therefore describes unauthorised access and possible disclosure, but does not establish the precise scope of access, whether all listed information was actually taken, or the underlying control failure.

How Cleverer may have helped

For this kind of incident, clear access controls for staff computers, documented handling of participant information, staff training, monitoring and tested response procedures may help an organisation identify and contain unauthorised access. Maintaining current evidence of these measures, together with investigation records, access logs and decisions about notifications, could make it easier to establish what happened and demonstrate how reasonable steps were considered.

This would not mean the incident was necessarily preventable. Evidence and governance records may assist with oversight, investigation and communication, but they do not guarantee that an incident, regulatory finding or other consequence will not occur.