Australian agencies probe VIQ offshore data risk as scrutiny widens

Traders Union
All News
Regulators
Australian agencies probe VIQ data

Highlights

Freedom of Information documents reveal the ATO and ASIC suspended VIQ Solutions in March 2025 after data from a UK server link raised concerns of offshore data exposure.
By May 2025, VIQ Solutions characterized the incident as a 'near miss' with no confirmed compromise, but there was no cross-agency investigation despite at least 13 agencies using VIQ.
ASIC removed VIQ Solutions from AusTender on March 19, 2026, following the company's administration and ongoing investigations into a court data breach impacting supplier eligibility and political scrutiny.

FOI documents detail 2025 response

As reported by ABC News, Freedom of Information documents show the ATO and ASIC investigated a potential breach after VIQ Solutions sent material that appeared to be accessible from the UK, raising fears sensitive government data had been sent offshore in 2025.

The issue surfaced around March 2025 when VIQ emailed the ATO with a hyperlink to a transcript available for download from a UK-based site. An ATO assistant director warned ASIC and VIQ that the link appeared to show customer data could already be shared, accessed or used outside Australia, which the agency described as a serious concern.

Both the ATO and ASIC told staff to stop using VIQ for transcription services while they sought more information. Emails also show the ATO later raised concerns about potential inconsistencies in VIQ’s explanations as questions about the incident widened.

By early May 2025, VIQ had provided a report to ASIC, which concluded the matter was a “near miss” and that none of its own data had been compromised. However, the documents do not show an independent review across other agencies using the supplier, despite the ATO raising whether the impact extended more broadly.

Supplier oversight and wider government impact

Sensitive court and federal agency data is not allowed to be stored or processed offshore because of cyber security and national security risks. Emails indicate ASIC, which managed the relationship with VIQ as a preferred government provider, left notification of any separately affected agencies to the company rather than conducting a broader cross-government assessment itself.

The court data breach later became public, and VIQ Solutions was subsequently placed into administration before shutting down. ASIC removed the company as an approved supplier from AusTender on March 19, 2026, and at least 13 government agencies had used VIQ before that step.

The ATO says it reported the incident to the relevant panel manager responsible for assessing Commonwealth risks, while ASIC says it took appropriate action and that VIQ was responsible for notifying agencies affected under separate arrangements. Investigations into the court data breach remain ongoing.

The latest disclosures add to political pressure for a broader review. Shadow Attorney General Michaelia Cash says the expanding concerns over data integrity warrant an investigation coordinated by the Attorney General across all government agencies, while a July report by administrator McGrath Nicol says the breach hurt VIQ’s ability to win tenders and suggests the company’s directors may have failed to act with due care and diligence.

In our earlier article on CTOS Digital’s cybersecurity incident, we examined how the disruption was expected to weigh on the company’s earnings and market sentiment. The piece outlined management’s estimate that the breach could cut net profit and revenue for the year if services remained partially unavailable, and noted that prolonged downtime could further increase costs and pressure customer confidence.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.