News
NDIS myGov Data Breach: What Participants and Families Need to Know Right Now
NDIS Participants Urged to Act After myGov Security Breach
For many Australians with disability, the NDIS is more than a funding system. It helps make daily life possible through essential supports, assistive technology, housing, and care services.
That’s why the latest cyber security alert affecting some NDIS participant accounts has become one of the most significant disability sector developments of the past week. The National Disability Insurance Agency (NDIA) has confirmed that cyber criminals have gained access to some NDIS accounts through myGov phishing activity and by convincing people to share their login details. [ndis.gov.au]
While the breach was not caused by a failure of the NDIS system itself, it highlights a growing risk facing participants, families and carers across Australia.
Here’s what happened, who may be affected, and the practical steps you can take to protect yourself and your loved ones.
What Happened?
On 27 July 2026, the NDIA issued a public warning about a myGov-related security incident affecting some NDIS participant accounts. The agency reported that cyber criminals had used phishing techniques and other forms of deception to obtain login credentials, allowing them to access participant information and accounts. [ndis.gov.au]
Phishing is a type of scam where criminals impersonate trusted organisations through emails, text messages, phone calls or fake websites. Their goal is to convince people to hand over usernames, passwords, verification codes or personal information.
In this case, the criminals reportedly gained access through participant myGov credentials rather than through a direct compromise of NDIS systems.
Why This Matters
For many NDIS participants, online accounts contain sensitive personal information, including:
- Contact details
- Support information
- Funding information
- Claims and payment records
- Plan details
- Linked government services
A compromised account can create significant stress for participants and families, particularly those already navigating complex support needs.
Who Could Be Affected?
- Current NDIS participants
- Families managing participant accounts
- Nominees and guardians
- Carers
- Plan managers
- Support coordinators
- Disability support providers
- Anyone who accesses NDIS services through myGov
Importantly, even if you have not noticed suspicious activity, it is worth reviewing your account security.
Signs Your Account May Have Been Compromised
You should take immediate action if you notice:
- Unexpected changes to your account details
- Notifications about logins you do not recognise
- Changes to banking information
- Unfamiliar claims or transactions
- Missing funding
- New contacts or representatives added to your account
Password reset emails you did not request
What Participants and Families Should Do Now
Change Your Passwords
Enable Additional Security Measures
Review Your NDIS Account Activity
Be Alert to Future Scams
Talk With Family Members and Carers
What This Means for NDIS Participants
The incident highlights an important reality: safeguarding your NDIS supports now includes protecting your digital information.
As the disability sector becomes more connected and services move online, cyber security is becoming a critical part of participant safety.
For NDIS participants, a secure account helps protect:
- Funding access
- Service continuity
- Personal information
- Provider relationships
- Financial wellbeing
While the incident is concerning, it also presents an opportunity for participants and families to strengthen their online security.
Â
Youngcare’s Perspective
At Youngcare, we understand that navigating the NDIS can already feel overwhelming for many people living with high care needs.
The last thing participants and families need is the additional stress of worrying about scammers and cyber criminals.
We encourage participants, carers and families to take a proactive approach to online safety. Small actions such as changing passwords, enabling additional security measures and regularly checking account activity can make a significant difference.
Youngcare Connect is a free national service that supports young people with high care needs and their families to navigate disability housing, NDIS pathways and support options. While Youngcare Connect can’t resolve cyber security incidents directly, the team can help participants and families understand what support may be available when unexpected challenges arise.
Whether you’re trying to understand your NDIS plan, explore housing options, connect with local services or find the right information, the Youngcare Connect team can provide guidance and point you in the right direction.
Many families tell us that one of the hardest parts of the disability journey is knowing where to start. Having someone to talk to who understands the system can make a real difference.
If you need support, advice or information, reach out to the Youngcare Connect team through the Youngcare Connect service.
Looking Ahead
The NDIA’s warning serves as a timely reminder that cyber threats are evolving rapidly. As more government services move online, participants and families will need ongoing support to stay safe in an increasingly digital environment.
The positive news is that there are practical steps everyone can take today.
By staying informed, remaining cautious and acting quickly when something seems suspicious, participants can reduce the risks and help protect the supports they rely on every day.
FAQs
Has the NDIS system itself been hacked?
The NDIA advises that cyber criminals gained access to some participant accounts through phishing activity and by persuading people to provide login credentials, rather than through a direct breach of NDIS systems. [ndis.gov.au]
What should I do if I think my account has been accessed?
Change your password immediately, review recent account activity, update security settings and contact the NDIA if you identify suspicious activity.
What is a phishing scam?
A phishing scam is when criminals impersonate a trusted organisation through emails, text messages, phone calls or fake websites to obtain personal information or login credentials.
Can family members help secure my account?
Yes. Families, carers, nominees and trusted supporters can help monitor account activity, update security settings and identify suspicious communications.
How can I reduce the risk of future scams?
Use strong unique passwords, enable multi-factor authentication, avoid clicking unexpected links, verify communications independently and regularly review your account activity.
Source:Â National Disability Insurance Agency (NDIA), “myGov data breach” announcement, 27 July 2026
Â
Â