Nigel Boyce: WA man demands answers after Perth lawyers lose USB with confidential details in data breach

A WA man injured in a workplace accident is demanding answers after an insurance company’s Perth lawyers lost a USB stick storing his personal and confidential details during a court visit. Nigel Boyce has been forced to change account and identification numbers with his bank and government agencies, including Medicare, to minimise the threat of identify theft following the loss of the stick, but he wants to know why he was not told of the data breach until a month after it went missing. It has now been confirmed that the USB also contained private information about 10 other people. In an email from insurer CGU on December 10, Mr Boyce was notified of “a data breach incident that has resulted in the loss of your personal information”. “We sincerely apologise for the concern this incident may cause you and our priority is your welfare following this incident,” CGU said. CGU wrote that it had been advised by the company’s lawyers, national firm Hall & Wilcox, “that an unencrypted USB containing your personal information was misplaced by a staff member . . . after they used it to copy subpoenaed documents at the WA District Court”. “The H&W staff member’s recollection, although they cannot be certain, is that the USB was returned to the H&W office in Perth before it was misplaced,” it said. “H&W has undertaken exhaustive searches but has not been able to locate the USB.” Mr Boyce was told the USB stick held his personal details, Medicare information, health and employment records, and details of his recently finalised insurance claim. However, he is also concerned that it may have also stored information about his partner and other family members. “We are really concerned that a high-profile law firm not only lost the USB but more shocked that it wasn’t even encrypted and jeopardised our privacy and could lead to potential identity theft,” Mr Boyce said. “I’m gobsmacked that it can happen.” He has questioned why he was not told of the missing stick closer to when it was misplaced on November 8. The 49-year-old, former Pilbara fly-in, fly-out worker has not worked since a truck ramp fell on him in August 2019, severely injuring his back. Two months ago, he settled his workers compensation claim with CGU, his former employer’s insurer, after a frustrating, protracted legal battle. Hall & Wilcox said the Office of the Australian Information Commissioner was told on December 6 “of a data breach relating to 11 individuals”. “The breach was caused by human error after a USB was misplaced,” chief operating officer Sumith Perera said. “Hall & Wilcox engaged IT forensic experts to assess what data may have been contained on the USB. “Based on this analysis, it was identified that the USB likely contained notifiable personal information.” The firm apologised and said it had taken steps “to further strengthen internal processes and systems to deal with the use of USBs”.