Home / Business and Economy / KPMG Breached Contract on Sensitive Govt Data
KPMG Breached Contract on Sensitive Govt Data
23 Oct
Summary
- KPMG Australia improperly transferred sensitive government material.
- Services Australia is considering terminating KPMG's contract.
- No data breach occurred, but new audit work for KPMG halted.
KPMG Australia has breached a contract with Services Australia, the country's largest federal agency, by transferring sensitive government material outside of its secure environment. This violation occurred in late 2025 and prompted officials to consider terminating the firm's contracts. The incident involved a KPMG employee sending a draft audit report marked "OFFICIAL: Sensitive" from a standard KPMG email account instead of a dedicated one for Services Australia.
Services Australia has not awarded new audit work to KPMG since the incident. Despite assurances from both KPMG and Services Australia that no data breach occurred, the agency's director noted the transfer was "explicitly prohibited under the contract" and recommended assessing further actions, including contract termination. KPMG stated the transferred document was an internal audit report template that had been deleted, and the employee involved would receive additional training.
An internal cybersecurity review in January concluded the risk of a data breach was low. However, Services Australia has considered its contractual options and confirmed no additional internal audit work has been awarded to KPMG since. The government has also extended a ban on KPMG bidding for new federal work until February 28, 2026, while the firm addresses cultural and governance weaknesses.
