Reports that passport scans were among documents published following the Bathurst RSL cyber incident raise an uncomfortable question for Australian businesses: how many copies of sensitive identity documents are sitting in systems nobody regularly checks? In David Hollingworth's Cyber Daily report of 26 October 2026, chief executive Peter Sargent said the incident was contained, specialist cybersecurity experts had been engaged and operations continued normally. Investigators had confirmed gaming and membership management systems were unaffected. Authorities had been notified, and the club was contacting people whose personal information was involved.
Cyber Daily describes 30 documents published by Qilin, including passport scans and applications appearing to belong to staff, after the group listed the club as a breach victim on 22 October. The club declined to comment on the third party's claims. The total extent of any theft, intrusion method and discovery date remain unestablished in the public account.
An unaffected membership system can coexist with exposed information elsewhere. The report does not establish where these documents came from or that the club's retention practices were unlawful or negligent. It does, however, raise a useful question for other businesses: how much identification paperwork sits outside the systems they normally think of as holding personal information?
The administrative task ends. The copies remain.
Consider what can happen when someone emails a passport scan for an employment check. The attachment arrives in a mailbox. An administrator downloads it, perhaps saves it in an onboarding folder, then forwards the message to whoever completes the check. A cloud service may synchronise the folder to another computer. Backups preserve the mailbox, the folder or both. None of this requires an unusual workflow or a deliberate decision to build an identity-document archive.
The administrative task may be completed within a day, but copies of the documents can remain scattered across different systems for years. Deleting the downloaded file does nothing to the original message or its forwarded copy. Removing it from a shared drive may leave an older version or a recoverable item in the service. A laptop retired months later can still hold the local copy. The business may have a perfectly sensible approved storage location while additional copies persist outside it.
That is why asking whether a business keeps passport copies can produce an incomplete answer. The person responsible for employment checks may know what belongs in the personnel folder without knowing what the email platform retains. The IT provider may know how long backups run without knowing which attachments contain identity documents. Each can understand their part of the arrangement while nobody has a complete account of what is held.
These are ordinary infrastructure examples, not findings about Bathurst RSL. They matter because a passport or driving licence image can supply details useful for impersonation or fraudulent verification attempts, especially alongside other information. An image alone does not automatically enable someone to open a bank account or obtain credit; the receiving organisation's verification controls still matter. But distributing copies across everyday working systems gives a business more places to protect and more uncertainty to resolve after a compromise.
Access follows the same accumulated pattern. A shared folder created for two administrators can acquire a wider audience as roles change. An external provider may retain broad access for support, or an old contractor account may survive the engagement it was created for. MFA helps protect a login, but it does not decide whether that account should still be able to download personnel records. That depends on permissions someone has examined against the work being done now.
A reason to check is not a retention policy
Inspecting a passport, recording that verification occurred and keeping a complete image serve different purposes. An employer may need to establish identity or work rights. A regulated business may need evidence of customer verification. Neither situation can be reduced to a blanket instruction to delete the scan once someone has looked at it. Legal, regulatory and contractual obligations need to be understood for the particular record.
Equally, a general retention rule can be stretched well beyond what it actually covers. The Fair Work Ombudsman's seven-year rule concerns time and wages records. It does not supply a universal expiry date for every identity document attached to an employment file. Migration-related checks and regulated financial services require their own assessment. “We keep all staff paperwork” leaves the underlying decision unresolved.
For information handling covered by the Australian Privacy Principles, APP 11 requires reasonable steps to protect personal information against misuse, interference, loss, unauthorised access, modification or disclosure. It also requires reasonable steps to destroy or de-identify information no longer needed for a purpose permitted under the APPs, with exceptions for Commonwealth records and retention required by Australian law or a court or tribunal order. Protection and decisions about continued retention belong in the same conversation.
The legal position varies. As the OAIC's small-business guidance explains, many businesses with annual turnover of $3 million or less are generally exempt, although exceptions include certain health service providers and businesses trading in personal information. The employee records exemption can cover particular handling directly related to current or former employment; it does not simply exempt all recruitment material. APP 11 is therefore not a universal obligation for every small employer or file. The practical problem of protecting unnecessary copies remains even where an exemption applies. The Attorney-General's Department's guidance for businesses also advises limiting identity information collected and disposing of it responsibly when no longer required.
A workable retention arrangement has to reach the systems that actually hold the records. A date in a policy will achieve little if nobody knows which mailboxes, cloud folders or administrative computers contain copies. Backups complicate this further: a document removed from everyday use can remain recoverable, and restoring an older backup can bring it back. Expiry arrangements, restricted access and a way to handle restored records give disposal decisions practical effect.
This is also where an independent review can be useful. Solway Web Consulting's small-business cyber security review provides a starting point for examining account, email and backup risks. A cybersecurity review can help identify where sensitive information is stored, who has access to it and whether outdated accounts or unnecessary copies are creating avoidable risks. Questions about legal retention obligations still need appropriate legal advice.
Understanding those connections matters during an incident too. An account's permissions may show that it could reach a folder; they do not prove which files were downloaded. Available logs may help narrow that gap, but missing evidence can leave a business unable to give affected people a definite answer. Knowing what was held and who could reach it makes that investigation less dependent on reconstructing years of administrative habits.
The original identity check may have been entirely justified. Years later, a passport scan in a forgotten mailbox needs a continuing reason to be there. The fact that a business once needed to see it does not settle how long every copy should remain.
Tags: security, small-business, australia