Data of 15+ Million Myki Cards in Australia has been Leaked

More than 15 million myki cards in Australia have been leaked, involving 1.8 billion events.

On August 15th, the Victorian Information Commissioner’s Office (OVIC) in Australia found that data released by Victorian Public Transportation (PTV) revealed travel records in 15,184,336 myki cards (Melbourne’s proprietary smart system bus cards), violating the The Privacy and Data Protection Act of 2014 (PDP Act 2014).

The leaked data relates to the travel records of myki card users during the period from July 1, 2015 to June 30, 2018, totaling approximately 1.8 billion events. Each event record contains multiple data, including date and time, location information, card identifier (a unique number for each myki card), and type (such as a student card). This data can be utilized and re-identified as an individual.

Lead researcher Chris Culnane, from the University of Melbourne’s School of Computing and Information Systems, said, “That is a significant concern because you obviously have a lot of information about yourself, so finding your own card is easy but finding someone else’s card from maybe one or potentially two events, you can then identify cards for people you travelled once with for a night out or for work and identify their travel patterns for a three-year period.”

OVIC released a report on the myki card information disclosure detailing the activities that led to the easy identification of these data. Victoria Information Commissioner Sven Bluemmel said that flaws in data risk management could lead to privacy leaks, but OVIC’s release of myki card data is well-intentioned, such as hosting contests and encouraging participants to find new uses for data sets.

If you use a myki, your data might be compromised. How to protect your data? Culnane says, “Can we reduce the type of information that maybe reveals allocation? And just be a little bit more cautious about what date we share with organisations as well as social media to try to reduce our data footprint overall.”

Published by on August 19, 2019 2:12 am, last updated on August 19, 2019 2:12 am