Company Announcement - Data Security Incident

Murray Irrigation Limited has been made aware of a data breach involving a set of Landholder information contained within the ArcGIS Online platform. The data breach has not occurred as a result of an issue with the ArcGIS platform. This data breach involves some personal information of certain Landholders. 

Importantly, upon discovery of the breach, Murray Irrigation immediately locked down the ArcGIS platform and can confirm Landholder data is no longer available publicly on the ArcGIS platform. 

We take the security and privacy of your information very seriously and want to explain what happened, what information was involved, and what steps you can take. We will complete a full external investigation to ensure Murray Irrigation does everything within its power to contain the incident and prevent this from occurring again. 

What happened. 

ArcGIS is a geographic information system platform used to create, manage, analyse and map location-based data. Information on Murray Irrigation Landholders is held within this program to support the delivery of Murray Irrigation’s core services. This information is not ordinarily visible publicly. 

On 18 December 2025, Murray Irrigation identified a data security incident involving information held within the ArcGIS platform that is ordinarily confidentially and safely maintained. Some of this information was unintentionally made publicly available. The incident was not a result of a malicious attack or attempt to access information by an external actor. 

Categories of information made public. 

• LRN 
• Landholding area (Hectares) 
• Chemical-free status 
• Customer number 
• Names 
• Postal address 
• Phone numbers and email addresses 
• Water account balances (WEs, DEs, Entitlement Class) 
• Customer flags
• Works Supervisor names and accompanying phone numbers 

Importantly, this incident has not involved any information other than what is listed above, and in particular has not included payment information, bank account information, passwords, WEX data or A-account information. 

This data breach has also not involved all customers of Murray Irrigation and is limited to Landholding related data. 

Company response. 

Upon discovering the incident, Murray Irrigation has taken immediate steps to: 

• contain the data breach to prevent any further disclosure, 
• assess the data breach to determine causes, potential harm, the scope of the breach and to remediate any further harm, and 
• launch an investigation to ensure Murray Irrigation does everything within its power to prevent this from occurring again. 

MIL will also engage an external investigator to review the circumstances and assist to design a plan to prevent this from happening again. 

Through this notification, Murray Irrigation is notifying affected Landholders and the Office of the Australian Information Commissioner and Privacy Commissioner. 

The containment process involved immediately locking down the ArcGIS platform upon discovery of the breach. Murray Irrigation can confirm Landholder data is no longer available publicly on the ArcGIS platform. 

Recommended Landholder response 

Murray Irrigation recommend Landholders who have been affected by the breach to: 

• Remain vigilant for suspicious emails, messages, letters, suspicious invoices or phone calls 
• Double check any invoices received from Murray Irrigation including 
• Bank account details – Murray Irrigation’s current bank account details can be found here: https://www.murrayirrigation.com.au/anz 
• Sender email 
• Timing of invoice 
• Avoid clicking on unexpected links or sharing personal information 
• Consider changing passwords associated with your account(s) 

If you are unsure on any of the above details, please contact Murray Irrigation on 1300 138 265 to confirm or request assistance. 

Further information 

We sincerely regret any inconvenience or concern this incident may cause. Protecting your information is extremely important to us, and we are committed to maintaining your trust. 

We will continue to update Landholders as more information regarding the incident becomes available.  For further information, please contact the Customer Experience team on 1300 138 265.