A major data breach has exposed the private information of up to 3,000 northern NSW residents affected by the 2022 floods.

The NSW Reconstruction Authority (RA) said in a statement the breach occurred in March and involved more than 12,000 rows of data in a spreadsheet from the Northern Rivers Resilient Homes Program.

“Personal information was uploaded by a former contractor of the RA to the Artificial Intelligence platform ChatGPT,” an RA spokesperson said.

The statement said once the full scope of the breach was understood, the RA took steps to contain the risk and began working with Cyber Security NSW and forensic analysts.

“We are undertaking detailed investigations to understand what was shared, what the risks are and who from the program is impacted,” the statement read.

The Northern Rivers Resiliant Homes program assists residents affected by flooding by buying back homes in areas with high flood risk, or making homes more resilient to future floods.

weatherboard home off its stumps, with security fence around it

Home buybacks have been underway since flooding hit the Northern Rivers region of NSW in 2022. (ABC North Coast: Bronwyn Herbert)

The breach shared the names and addresses of program applicants, as well as email addresses, phone numbers, and other personal and health information.

“There is no evidence that any information has been made public, however this cannot be ruled out,” the statement said.

“The process is highly complex and time-consuming and we acknowledge that it has taken time to notify people. Our focus has been on making sure we have all the information we need to notify every impacted person correctly.”

A row of houses down one side of a street, all surrounded by temporary fencing. The closest one has boarded up windows.

The breach may have impacted up to 3,000 people from the NSW Northern Rivers. (ABC News: Emma Rennie)

Minister ‘really sorry’

NSW Minister for Recovery and Lismore MP Janelle Saffin said she received a preliminary report about the breach in July, and the final report on Friday.

Ms Saffin said she had asked the RA to review and report on the situation and the department’s processes, including its timeliness.

“I would prefer [for the RA] to advise people sooner, and I’m also informed they couldn’t identify everybody, but I need to see the report first,”  she said.

“This is our community, my community, so I’m really sorry.”

Ms Saffin said the situation was “being treated with care and consideration”.

The RA said it would contact people this week with updates about how they had been affected and the support available.