A major data breach that exposed the personal details of almost 10,000 people in detention was caused by Immigration Department failures to check and approve documents for web publication, an independent review has found.

The report by management consultants KPMG, which was published on Thursday, reveals that the document containing the information was approved for publication by an assistant secretary at the department.



Guardian Australia revealed the data breach, one of the largest in Australian history, in February. The publication of the personal information, mostly of asylum seekers in Australia, raised serious safety concerns for those affected.



The document, which contained personal information such as names, dates of birth, location and nationality of those in detention - was downloaded 123 times “from multiple sources” with 104 unique IP addresses, the review found.



Its key findings are:



Confusion within the department surrounding the clearance checks that needed to be undertaken for publishing material on the web.

Checks of documents to be published online occurring on physical versions of documents, rather than online versions.

The data breach occurred despite approval from an assistant secretary of the department.

The individual who authored the document had never previously prepared the material, leaving the process “more susceptible to human error”.

The findings of the review, which was commissioned by the department, also appear to contradict responses given by the department at Senate estimates questions on 26 May - after it had received the report – that “there were 26 known downloads”.



Internal correspondence within the department, obtained through freedom of information, revealed officials had previously been unaware how many times the file had been accessed.



According to KPMG the “potential data access and distribution is widespread”, raising further concerns about the risks asylum seekers who were named in the breach could face if they are returned to their countries of origin.



The report states that “neither the content authors, nor the director of the responsible reporting team” were aware that they were responsible for assuring material was appropriately monitored and controlled for publication on the web.



“Authors and approvers were generally unaware that the IT security risk which led to this incident, could occur and were therefore not mindful of checking for indicators of this risk,” it said.



It describes how an employee who had never prepared the type of document before created the file. The process was normally automated, but was “manually expedited” to meet a target publishing date.



“The document was escalated through the responsible web management team’s clearance process, which involved review and approval up to assistant secretary level. The reviews resulted in various amendments to the document, with the incident occurring at some point in the process of making those amendments.”



David Manne, executive director of the refugee and immigration legal centre, said the breach placed asylum seekers at a “real risk of retribution from those they’ve fled from”.



Hundreds of those affected have complained to the privacy commissioner, who is conducting an own motion investigation into the breach.



Dozens of asylum seekers are also appealing to the federal court to halt their deportation, arguing that the breach could give them a stronger claim to refugee status.



Last week some asylum seekers affected by the breach received a letter telling them they had just 14 days to explain how the breach changed their protection claim, before they faced being returned.



The review recommends that the department develop procedures for “cleansing” personal data, update review procedures, develop an IT security training program and incorporate privacy training in connection with the Australian Privacy Principles.

