The information below was updated 25 June 2018.

EnergyAustralia is among a number of businesses in Australia that uses the PageUp platform for recruitment.

We were recently alerted to unusual activity on PageUp's systems and immediately suspended our use of the platform for collection of candidate information.

A detailed statement from PageUp regarding the incident can be found here.

We have maintained close contact with PageUp since being advised of this issue. While there is currently no evidence that candidates for roles at EnergyAustralia have had their personal information extracted from PageUp’s systems, we are continuing to monitor this issue. We are also encouraging candidates for roles at EnergyAustralia after 30 September 2013 to be alert to any potential misuse of their personal information, as an additional precaution.

Based on advice about the current state of PageUp's systems and the steps it has taken to secure candidate information and prevent similar incidents occurring in the future, EnergyAustralia has recommenced the use of PageUp effective 18 June 2018.

If you are interested in an available role at EnergyAustralia but concerned about submitting your details via PageUp, please contact our Careers team directly by emailing careers@energyaustralia.com.au.

For general advice regarding the security of your information online, please refer to the ACCC's Scamwatch website or IDCARE's Cyber First Aid Kit.

FAQs

Has my personal information been accessed?

While investigations continue, on the balance of probabilities, certain elements of your personal data may have been accessed without authorisation. At this stage there is no evidence that your data has been transferred outside of PageUp's systems, only that it may have been accessed.

What type of information is at risk?

The system on which PageUp detected unusual activity holds information including names, street addresses, email addresses, and telephone numbers.

Importantly, PageUp says it is confident that the most critical data categories including resumes, financial information, Australian tax file numbers, employee performance reports and employment contracts are not affected in this incident.

Are passwords at risk?

PageUp says some employee usernames and passwords may have been accessed but are protected using industry best practice techniques, so any risk to them is low. As a precaution however, you may consider changing your password.

Are my bank account details at risk?

PageUp says it is confident that financial information is not affected by this incident.

What precautions should I take?

At this stage, there is no evidence that our candidates' information has been compromised. However, we recommend the following steps to protect your online security. Many of these steps are normal good practice for online security:

  • change your passwords on other online services, if you re-use the same password;
  • enable multi-factor authentication and other available security measures provided by your other online services;
  • be aware of potential phishing emails and telephone calls from businesses or institutions requesting your personal details. Avoid opening attachments from unknown senders via email or social media;
  • install anti-virus software and keep it updated; and
  • apply all recommended software patches from operating system and software providers.

You can find additional guidance on how to protect your identity and respond to identity concerns by visiting the OAIC's data breach guidance for individuals and IDCARE's Learning Centre.

What is PageUp – is it software that EnergyAustralia uses?

PageUp is a HR platform. It is used by many Australian businesses including EnergyAustralia for things like recruitment. It is an online platform rather than software hosted at client premises.

What has EnergyAustralia done to protect candidate information?

On being alerted to this issue EnergyAustralia suspended use of PageUp for recruitment and posted advice for candidates on its website. While there is no evidence currently of information about candidates for EnergyAustralia roles being extracted from PageUp, we have, out of an abundance of caution, commenced emailing candidates to update them.

We have now re-established use of PageUp, based on their assessment of their current security measures.

If I was an unsuccessful candidate for a role, am I still impacted?

Applications from both successful and unsuccessful candidates are held in PageUp.

Is more information at risk if I was a successful candidate for a role?

PageUp also supports the appointment and onboarding process for new employees at EnergyAustralia. PageUp has advised that if an applicant succeeded in securing a role at EnergyAustralia or progressed beyond the interview to the next stage of the recruitment process, the potentially impacted data also includes date of birth.

Where can I find more information?

A detailed statement from PageUp regarding the incident can be found here.

If you have questions related specifically to this incident, please call the hotline established by PageUp for assistance. The number to call is 1300 893 787.