Only one gun dealer accessed data – police

Police have confirmed only one ‘‘log in’’ accessed the personal details of thousands of gun owners in a data breach and the details of 35 people had been obtained.

The breach occurred after an external software developer, German company SAP, updated the system in a way which had not been authorised by police.

Police Minister Stuart Nash said not being told about the significant change was ‘‘poor form’’.

He was told that 66 gun dealers had access to the information since November 27 and SAP evidence shows only one person had accessed it. ‘‘They worked overnight to go real hard on this . . . they are adamant that only one person accessed it.’’

The details of more than 37,000 firearm owners, including the guns they possess and bank account information, were able to be accessed in the breach, according to the Council of Licensed Firearms Owners (Colfo).

The gun lobby group said it had received the data from a supporter and has released some images obtained in the breach, with personal details redacted.

It claims 19 people had been able to access the information but police had nothing to substantiate this.

The Government would look at whether police would continue to use SAP after it ‘‘got to the bottom’’ of the data breach, he said.

‘‘This is very disappointing. It is not something that police have done wrong and certainly not something that I authorised.

‘‘I will not be resigning on this.’’

Police Deputy Commissioner Mike Clement said police had requested information from Colfo leaders.

‘‘Nothing has been provided to date, but police continue to liaise with Colfo,’’ he said. ‘‘A system audit by our vendors over the last 24 hours has confirmed only one log in by a dealer with legitimate access to the platform.’’

Police had spoken with that dealer and had confirmed the information they accessed has not been used in any way.

Based on the audit, police confirmed that full details for 35 people were accessed and included name, address, contact number, firearms

Police would be contacting the 35 people to inform them of the privacy breach.

licence number and bank account details. Police would be contacting the 35 people to inform them of the privacy breach, provide advice on what they can do to ensure the ongoing security of their information and answer any questions.

Fewer than 500 people had their name and addresses accessed and police would inform them too. For those who took part in the firearms buy-back programme but were not contacted by police, their details had not been accessed, he said.

The online notification platform is still offline and will remain so until police can be sure that the system is secure.

The privacy commissioner was looking into the breach.