--- title: "VIQ Australian court-recording access incident" description: "The OAIC found that a permission error gave an overseas subcontractor access to Australian court recordings held by VIQ Solutions Pty Ltd." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-04" canonical_url: "https://www.ally.security/incidents/viq-australian-court-recording-access-2025" markdown_url: "https://www.ally.security/incidents/viq-australian-court-recording-access-2025.md" stix_url: "https://www.ally.security/incidents/viq-australian-court-recording-access-2025/stix.json" --- # VIQ Australian court-recording access incident The OAIC found that a permission error gave an overseas subcontractor access to Australian court recordings held by VIQ Solutions Pty Ltd. Last modified Nov 4, 2026 · 1 source ## Summary - **Environment:** Australian court transcription work pools - **Operational impact:** Recordings from 93 court matters accessed outside approved arrangements - **Financial impact:** No incident cost disclosed ## What happened The [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) found that a permission error gave an overseas subcontractor access to Australian court recordings held by [VIQ Solutions Pty Ltd](https://viqsolutions.com/). [1](#source-1) ## Impact Five India-based subcontractor employees received access; three used it for transcription. The OAIC identified snippets from 93 court matters, including two ceremonial sittings, rather than 93 affected people. [1](#source-1) ## Timeline ### February 6, 2026 — Last recorded access Last recorded access, according to the published account. [Inquiry report](https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/viq-solutions-pty-ltd-and-commonwealth-agency-contracting). [1](#source-1) ### February 11, 2026 — Access revoked Access revoked, according to the published account. [Inquiry report](https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/viq-solutions-pty-ltd-and-commonwealth-agency-contracting). [1](#source-1) ### November 4, 2026 — OAIC publishes inquiry findings OAIC publishes inquiry findings, according to the published account. [Inquiry report](https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/viq-solutions-pty-ltd-and-commonwealth-agency-contracting). [1](#source-1) ### November 4, 2026 — Briefing updated This briefing was last reviewed and updated on November 4, 2026. ## Threat Group & Attack Vector VIQ’s parent inadvertently added subcontractor staff to Australian work pools, granting access from September 2025 until February 11, 2026. The OAIC characterized this as unauthorized access within VIQ’s systems, not release of the files to foreign actors. [1](#source-1) ### Actors - The disclosure attributes this incident to an error; it does not identify a threat actor group. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Access was revoked on February 11, 2026, after the last recorded use on February 6. The OAIC closed preliminary inquiries without further action, citing the narrower scope, court responses and VIQ’s liquidation. Its report did not make concluded findings of legal liability. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### VIQ Solutions Pty Ltd and Commonwealth agency contracting regulatory · Office of the Australian Information Commissioner · Nov 4, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** Last recorded access: 2026-02-06 2. **Resulted In · 100% confidence · current** VIQ Australian court-recording access incident: VIQ’s parent inadvertently added subcontractor staff to Australian work pools, granting access from September 2025 until February 11, 2026. The OAIC characterized this as unauthorized access within VIQ’s systems, not release of the files to foreign actors. 3. **Resulted In · 100% confidence · current** VIQ Australian court-recording access incident: Five India-based subcontractor employees received access; three used it for transcription. The OAIC identified snippets from 93 court matters, including two ceremonial sittings, rather than 93 affected people. 4. **Resulted In · 100% confidence · current** VIQ Australian court-recording access incident: The OAIC found that a permission error gave an overseas subcontractor access to Australian court recordings held by VIQ Solutions Pty Ltd. 5. **Affected Organization · 100% confidence · current** VIQ Australian court-recording access incident: VIQ Solutions Pty Ltd 6. **Resulted In · 100% confidence · current** VIQ Australian court-recording access incident: Last recorded access 7. **Occurred At · 100% confidence · current** Access revoked: 2026-02-11 8. **Resulted In · 100% confidence · current** VIQ Australian court-recording access incident: Access revoked 9. **Occurred At · 100% confidence · current** OAIC publishes inquiry findings: 2026-11-04 10. **Resulted In · 100% confidence · current** VIQ Australian court-recording access incident: OAIC publishes inquiry findings 11. **Resulted In · 100% confidence · current** VIQ Australian court-recording access incident: Access was revoked on February 11, 2026, after the last recorded use on February 6. The OAIC closed preliminary inquiries without further action, citing the narrower scope, court responses and VIQ’s liquidation. Its report did not make concluded findings of legal liability.